Smartphone longevity didn't used to matter. In the past, before you could wear out or break a phone, there was always some shiny new thing to buy. Today, we expect our smartphones to go the distance, but they've also become less repairable and, in many cases, more fragile. Fairphone, a Dutch smartphone maker that has just entered the US market, thinks about phones differently.

The new $650 Fairphone Gen 6+ is designed both for longevity and easy repairability. There are trade-offs to this approach if you're used to the standard glass and aluminum sandwiches filled with glue, gaskets, and teeny-tiny screws. But the drawbacks could be worth it for the right buyer. Fairphone CTO Chandler Hatton told Ars that Fairphone's goal is to provide a compelling mobile experience while also enabling the user to "fully own" their device. At the end of the day, this is what a lot of people say they want in a smartphone.

Take it apart, put it back together

These days, Google, Samsung, and Apple support phones with software updates for the better part of a decade, but will the hardware last that long? And what happens when it needs a repair? You may be out of luck or out a lot of money, but Fairphone prioritizes the self-repair experience.

"We're doing something that was long thought to be nearly impossible," said Hatton. "Which is delivering high-performing modular smartphones that can last for a very long time."

The Fairphone Gen 6+ has a 6.31-inch OLED screen, which is, of course, fully replaceable. Credit: Ryan Whitwam

Fairphone designs devices to be sustainable, focusing on avoiding conflict minerals, using recycled materials, and paying workers a living wage. Fairphone says it doesn't want to sell you a bunch of phones, just one that you can keep using even if something breaks.

"Our goal is that every single person that purchases a Fairphone uses it for at least five years, and we track that as a KPI [Key Performance Indicator]," said Hatton.

The standard way to design a modern smartphone is to cram as much as you can into an aluminum and glass sandwich, with the expectation that it will be assembled once in a factory and never opened by the buyer. Devices rely on glue and awkwardly placed screws to accomplish this, making the internals a little like metal spaghetti.

The Gen 6+ is designed so that anyone can replace parts, reducing e-waste and potentially saving consumers a lot of money. If you've had, say, a Samsung Galaxy phone for a couple of years and need to replace the screen or USB port, the cost might be higher than just buying a new phone.

"There is an incentive in terms of planned obsolescence to replace your device," said Hatton. "On the one hand, it's a good way to keep selling devices, but that's simply not the proposition that we have."

That means designing the phone differently—it's not just a matter of skipping the glue. Inside, the Fairphone Gen 6+ is clean and orderly. It starts with a pair of T5 Torx screws exposed on the back of the phone. After removing those, the back cover slides off. With the same driver, you can extract the battery, camera modules, USB-C port, display, and more. In all, the phone supports user replacement of 12 different parts with just that one (included) screwdriver. One drawback is that the modular approach makes the phone a millimeter or two thicker than most glued-together phones.

The phone comes with a tiny screwdriver, but any T5 torx will work. Credit: Ryan Whitwam

The battery stares you in the face once the back panel is opened. You'll have to remove a few more screws to get it out, but quick swapping isn't the goal here—this is about longevity.

"We know that after about three years, it will be wise to replace your battery with a new one," said Hatton. "Batteries aren't meant to last forever, but your phone on the whole can last a lot longer than a battery."

While the Fairphone is designed to be disassembled, what about the long haul? The Fairphone 6+ is mostly plastic rather than metal like a Pixel or iPhone. The phone still manages to feel solid, though, thanks to its internal metal frame, and the company has worked to ensure the device doesn't become progressively less sturdy as you tinker with it.

"When we're in our product development cycle, we introduce tests that are specifically dedicated to disassembly and reassembly," said Hatton. "So we're looking in part at the robustness."

Robots work the assembly line, but humans are less predictable. Hatton pointed to tests that examine, for example, what happens when someone over-tightens screws while servicing their device. Does it warp the casing? Damage any nearby components?

Hatton said it takes her 15 minutes to fully disassemble a Fairphone Gen 6+, but she did have a hand in designing it. That said, it shouldn't take a novice much longer. After a couple of minutes perusing Fairphone's documentation, I was able to take the phone apart and remove all of the user-serviceable components in about 20 minutes. Everything went back together without issue and still works perfectly, with no new gaps or wobble.

The process is pretty intuitive, with most of the parts held in with flat board-to-board cable connectors. Just pop them off with a spudger or your fingernail, and the component lifts right out. There are a good number of screws to remove to get all the way down to the metal frame and screen, but again, they all use the same T5 Torx bit.

Glass backs are common on smartphones because they're good for radio performance, and they add significant rigidity to the design. But they're also easy to crack and difficult to remove (they're almost always glued in place). Naturally, the only glass on the Fairphone 6+ is covering the 6.31-inch 1116 x 2484 OLED display, which is fully replaceable. This is probably the most challenging component to swap, but even this isn't too bad. The screen is held in place by a handful of screws and has a generously long ribbon cable attachment, making a swap much less frustrating than your typical smartphone.

The OLED is about what you would expect for this price range—the resolution is more than sufficient, and the colors are great. The brightness is good enough to be legible outdoors, but at a mere 1,300 nits peak brightness, it's harder to see than the displays you get on phones like the Pixel or Galaxy S26 that are a few hundred more expensive. Good luck replacing those displays on your own if you get a crack, though.

What specs make the cut?

Smartphones have become more powerful over the years, but their designs have also been streamlined. Headphone jacks and microSD card slots are now rare, and even the SIM card slot is quickly fading away. OEMs often cite the space constraints when dropping these features.

"There's a reason that most phone manufacturers prefer slightly larger footprints—because you can fit more stuff in there," Hatton said. "So yes, it is legitimate if phone manufacturers are saying, 'Hey, we dropped this feature to save space inside the device.'"

The Fairphone retains some of these elements, but not because there's a surplus of space, Hatton said. The Fairphone 6+ still has a microSD slot and physical SIM card because people want them. These features don't come free, though. In addition to the space constraints, adding more components adds to the price and complicates supply chains. That's another reason some OEMs have removed features.

Being modular means the Fairphone is a little thicker than most smartphones. Credit: Ryan Whitwam

The Fairphone Gen 6+ plays to picky smartphone and DIY enthusiasts, but there's still no headphone jack. Hatton notes that the team hears from a small but vocal cadre about headphone jacks every time it starts planning a new device, but it hasn't made sense to include one in recent phones.

"In terms of how to actually get [a headphone jack] into the device, it is quite difficult," Hatton said. "It's a relatively large hardware component, but it's not just the component itself. It's also where it needs to be. You know, you're not going to put the headphone jack in the middle of the back of the phone. You also need to make sure it attaches to the right things on the inside, and because we're Fairphone, you need to make sure it's repairable. So when we look at that total picture, we assess the needs of our customers to fulfill some other wishes at the expense of the headphone jack."

Looking at spec sheets side-by-side, the Fairphone also lacks something that many of today's phones have: IP6X water resistance. An upshot of making non-repairable phones that are chock-full of glue is that they're relatively easy to seal against water intrusion. With an IP6X rating, a phone can be fully submerged in water for up to 30 minutes, at least in theory.

The Fairphone Gen 6+ is only rated as IP55, which will protect it from splashes. That could be enough, though. "Our phones are designed for what people need on a day-to-day basis," said Hatton. "How often is it that people would like to take their hardware underwater? I think the answer there is less often than some manufacturers would have you think."

While it might be comforting to think you could drop your phone in a pool, that's still risky. OEMs don't warranty the water-resistance of their phones, and if you've made any repairs, it's possible the sealing of that difficult-to-open device was compromised. Hatton notes that it wouldn't be impossible to make a repairable phone that's also IP6X, but you'd have to design around that in numerous ways.

"There are a number of things that you need to weigh against a higher IP rating," Hatton said. "You can achieve it in a very small form factor with higher costs, or you can achieve it with a larger form factor—you could increase the Z dimension and perhaps also the other dimensions, and that way you could create all sorts of gaskets and other things. But we assess the whole landscape and say, 'Hey, the customer doesn't want a phone that's a brick.' They also don't want a phone that's incredibly expensive. So within those boundaries, what IP rating meets their needs?"

It's a trade-off, but it's one that many people would probably make in the name of repairability if given the choice.

Planning for the future

The Fairphone Gen 6+ is similar to the Gen 6 that launched in Europe last year, but there are a few notable changes. The new phone has a slightly upgraded Snapdragon chip, and it has more memory than the last Fairphone at a time when AI has driven up costs considerably.

"We decided to increase the RAM to 12 gigabytes," said Hatton. "This is something that I think is a little bit unique, given the current circumstances in the consumer electronics industry. But the reason that we did is that it really underscores the value proposition of longevity that we'd like our customers to enjoy when they purchase the Gen 6+."

Fairphone boosted RAM to 12GB for this release. Credit: Ryan Whitwam

Google, meanwhile, is catching some well-deserved flak for regressing from 16GB to 12GB of RAM in its latest Pixel phones, which start at $900. Samsung is also sticking with 12GB of RAM in its $2,000 foldables. And all those phones devote a lot of memory to AI services that not everyone cares about. The Fairphone has the Gemini app installed like all Google-certified Android devices, but the company has yet to create any on-device AI services of its own. That's on Fairphone's radar, but the team is taking a measured approach.

"We have not immediately jumped onto the bandwagon of creating AI features without really understanding what the use scenario is and what the customer really wants," said Hatton. "We see that people are quite interested in understanding how their data is used and having control over their data and privacy. That means that as we continue to use more AI in all sorts of different settings, we'll continue to work on AI features for our devices that focus on these aspects that are important."

Fairphone has been offering devices with generous support windows for years. The Fairphone 3, which launched in 2019, just reached end-of-life a few weeks ago. The Gen 6+ will be supported through 2033 with software updates and replacement parts.

Hatton says that multiple factors go into determining the length of support. The availability of hardware in the supply chain is part of it, but it becomes impossible to update devices once vendors like Qualcomm stop supporting the underlying firmware. Seven or eight years is the functional limit for any smartphone due to vendor support, so it's impressive to see Fairphone in the same range as the likes of Google and Samsung. It really can't do more than it's already doing here.

Is the Fairphone the right phone?

At $650, the Fairphone feels like a good deal in 2026. Maybe a year or two ago, the device wouldn't have seemed as competitive, but with price increases and RAM regressions becoming standard, Fairphone comes out looking much stronger with the Gen 6+. It has a solid mid-range Snapdragon chip, ample storage (with a microSD card slot), and 12GB of RAM, which is still flagship territory.

There's also something to be said for knowing that your phone is repairable if something goes wrong, and when the time comes to replace the battery, you can do it yourself in a few minutes. Fairphone is committed to keeping all these parts in stock for the duration of the phone's support window, which runs through 2033.

The Fairphone may not be everyone's style, but I like the utilitarian vibe. My design complaints are fairly limited and minor: the volume buttons are too low, and the power button (with fingerprint sensor) is too hard to find by feel.

Fairphone's version of Android is light on bloat. Credit: Ryan Whitwam

The modular design allows for a little fun in the form of accessory back panels. You can swap them just by removing the two external screws. There's a finger loop back (below), a card holder, and a lanyard that works with any of the backs. Hatton notes that the accessories also invite users to open up the phone to see how easy it is, something Fairphone recommends people get familiar with even if they don't have any accessories to swap—it's like knowing where the spare tire is in your trunk.

The Fairphone Gen 6+ runs a minimally customized build of Android 16, so it's a bit behind the latest and greatest. Thankfully, Google doesn't limit as many features to the latest builds of Android anymore. It has almost no bundled software outside of the standard Google apps, which is nice to see, but if you're hoping for a phone that's crawling with snazzy software features, this is not it.

One of Fairphone's few software customizations is called Moments, which you can toggle with the brightly colored side switch. Moments can help limit distractions by hiding most of your apps behind a minimalist UI. It's just a full-screen app overlay rather than a completely custom home experience, though. If you don't fancy the digital well-being approach to mobile tech, you can remap that switch. Using it as a flashlight toggle is nifty, for example.

The camera may be the biggest compromise if you switch from a Google or Samsung phone. The hardware is typical for the mid-range, with a 50 MP Sony 700C joined by a 13 MP OmniVision OV13B10. That third lens on the back is actually a window for a time-of-flight sensor that helps with focus. With ample light, both rear sensors produce good images, and the primary even does fine in some more challenging conditions.

Capture speeds are long, though, making it hard to get clear images of moving subjects. Colors look a bit flat, too, and autofocus speed seems on the slow side. There's a 32 MP selfie camera, which looks a touch dimmer than most devices in this price range.

The Fairphone Gen 6+ (left) might not be as sleek as the Pixel 11 Pro XL (right), but you don't need a hairdryer to open it up. Credit: Ryan Whitwam

With support increasing for making electronics more repairable, other companies may need to start moving in Fairphone's direction. In Europe, regulators are preparing to require removable batteries, and more US states are enacting right-to-repair laws. The Fairphone CTO stresses that other OEMs have what they need to make phones more repairable.

"We're producing our phones on the same production lines as our competitors, and often with many of the same components," said Hatton. "It's actually quite a small industry when you're in it, and there is very little room for one of our competitors to say it's impossible when on the next production line over it is happening."

The Fairphone Gen 6+ is available directly from Fairphone, as well as on Amazon. It's unlocked and works on both AT&T and T-Mobile.

Read full article

Comments

A colleague ran into trouble with their XAML program. They were using a FlipView control to bind to a collection, but when the user tried to navigate the FlipView using an assistive technology tool, there were cases where the navigation failed.

Some time later, they came back with the solution to the mystery.

The team noticed that their data model consisted only of strings and other value types, so they decided to declare their data model as a struct rather than a full runtimeclass, thereby avoiding a lot of boilerplate typing.

If defined as a runtimeclass:

// MyComponent.idl
runtimeclass MyPageContent
{
    String Title { get; };
    String Description { get; };
    String LinkUri { get; };
    Boolean IsNew{ get; };
}

// MyPageContent.h

namespace winrt::MyComponent
{
    struct MyPageContent : implements<MyPageContent>
    {
        MyPageContent(hstring const& title,
                    hstring const& description,
                    hstring const& link,
                    bool isNew) :
            m_title(title),
            m_description(description),
            m_link(link),
            m_isNew(isNew) {}

        hstring Title() const { return m_title; }
        hstring Description() const { return m_description; }
        hstring Link() const { return m_link; }
        bool IsNew() const { return m_isNew; }

    private:
        hstring m_title;
        hstring m_description;
        Windows::Foundation::Uri m_link;
        bool m_isNew;
    };
}

// Consumer.cpp

m_pages.Append(winrt::make<MyPageContent>(
                    title, description, link, isNew));

But if you define it as a struct, then most of this code isn’t necessary:

// MyComponent.idl
struct MyPageContent
{
    String Title;
    String Description;
    String Link;
    Boolean IsNew;
}

// MyPageContent.h not needed

// Consumer.cpp

m_pages.Append(MyPageContent(title, description, link, isNew));

Tastes great, less filling.

Now, the thing that makes value types value types is that they are copy-by-value, not copy-by-reference. This means that when XAML calls GetAt(n) on the m_pages to get the nth item, it gets a copy of the MyPageContent and binds to the copy.

And that’s the source of the problem.

When the code wants to navigate to a specific item at the request of the assistive technology tool, it passes the MyPageContent to navigate to, but that’s just another copy because value types are always passed by copy. XAML says, “I don’t have that guy” and fails the navigation. (XAML doesn’t realize that it has a guy who looks just like that guy. Not that it matters, because it’s not the same guy.)

The clever shortcut turned out to be the problem.

Now, while it’s true that there’s a bunch of typing needed to implement a C++/WinRT runtime class, there are helpers to reduce the amount of typing required. In the Windows Implementation Library (wil), the cppwinrt_authoring.h header contains classes to simplify the implementation of events and properties. It exploits CRTP in the same way I discussed some time ago.

// MyPageContent.h

namespace winrt::MyComponent
{
    struct MyPageContent : implements<MyPageContent>
    {
        MyPageContent(hstring const& title,
                    hstring const& description,
                    hstring const& link,
                    bool isNew) :
            m_title(title),
            m_description(description),
            m_link(link),
            m_isNew(isNew) {}

        wil::single_threaded_property<hstring> Title;      
        wil::single_threaded_property<hstring> Description;
        wil::single_threaded_property<hstring> Link;       
        wil::single_threaded_property<bool> IsNew;         
    };
}

We can get away with using a single_threaded_property because the properties are written only at construction, so concurrent reads are not going to cause problems.

The post The perils of binding to value types in XAML appeared first on The Old New Thing.

Gemini reportedly told a group of climbers that it would only take them eight hours to climb Mt. Shasta. They had to be rescued more than a day later.

Not long ago, I rented an SUV from a well-known car rental company. Within hours of an employee scanning my driver's license, a high-resolution scan of my ID was available for sale on the dark web.

An exposé published Tuesday by KrebsOnSecurity reports that my license was one of more than 153 million that were available through Nexus, the name of the new ID theft service. Like other driver's licenses available there—including some belonging to journalist Brian Krebs, his mother, an FBI assistant director, and several security researchers—my license was purported to include multiple image files showing both the front and back of the ID. Besides a basic image scan, the files also captured the images in the infrared and ultraviolet spectrums. Presumably, the additional formats may allow cloned-based counterfeit IDs to pass hologram tests.

Growing by the day

Besides advertising the availability of driver's licenses, Nexus offered to sell a bevy of other forms of ID. They included:

• identification cards
• travel cards
• international DL/ID
• medical cards
• common access cards
• residence cards
• employment authorizations

Krebs said the FBI is investigating.

Some of the records Krebs observed listed their “source” as “CDL,” which may be short for “commercial drivers license.” Other records identified the source notation as “CAC,” which may refer to Common Access Cards, which Krebs said are “government issued identity cards that grant physical access to government buildings and secure rooms.” Nexus also claimed to provide scans of marijuana dispensary cards. One of the victims he talked to reported visiting a Las Vegas outlet of Planet13, a multi-state dispensary chain.

The timing of newly available scans—typically within a day if not hours of me and a small sample of other victims presenting them at rental companies or others—likely means that Nexus has near real-time access to data flowing through the third-party scanning service these businesses are using. Over a span of 24 hours, Krebs said the number of driver's licenses listed as available grew by almost 400,000. That’s another indication the breach has been ongoing and new cards become available shortly after they’re harvested.

Using publicly available information, Krebs found that IDScan.net, a New Orleans-based ID scanning service, has announced an exclusive arrangement with Planet13. It also listed Hertz and 11 other companies as using its services. IDScan.net went on to say that its scans capture both infrared and ultraviolet spectra. The information suggests that the scanning service is connected to the breach.

Representatives from IDScan didn’t immediately answer questions sent by email. An IDScan.net spokesperson told Krebs the company is investigating. My car rental company representatives also didn't immediately answer questions.

The availability of my driver's license to anyone willing to cough up a fee isn’t exactly a comforting thought. Yes, my personal details—including current and former addresses, Social Security number, demographics, and more—have been breached before, just as they have for millions, if not billions, of others around the world. This dump is more troubling because of the purported availability of scans in ultraviolet and infrared. Fortunately, Nexus went dark within hours of the KrebsOnSecurity scoop. Also somewhat consoling is the ongoing investigation by the FBI.

Read full article

Comments

I filed a request with McDonald’s earlier this month to access all of the personal data the fast food company collected about me, and I received a stunning 515-page report a few days later that detailed my app interactions in granular detail and predicted I would never stop eating there.

Under the California Consumer Privacy Act, I have the legal right to request access to information from large companies that collect personal data. So I was curious what others might have on me, and I spent the next week filing more than 100 requests.

The CCPA went into effect in 2020, and three of its key provisions are the right to opt out of the selling of personal information, the right to delete that info, and the right to request a copy for yourself.

I focused solely on the latter—access requests—to better understand what data is being collected. Most companies must list two ways for you to file. These are often via a web form, phone number, or email address, as designated in their privacy policy. After you submit a request, companies can take 45 days to complete it.

My experience placing these data access requests was incredibly time-consuming, from finding the right filing methods to verifying my identity multiple times. Most exasperating during this process were the companies that either responded to my access requests with messages concerning the deletion of information, which I explicitly said not to do, or refused to process the request through a method listed in their privacy policy.

Consumer advocates I spoke with were upset with how these requests were handled. “That's crazy,” said Ben Winters, director of AI and privacy at the Consumer Federation of America. “That's not an acceptable status quo.” Winters sees these examples as exhibiting the weaknesses of policy frameworks that rely on companies to act responsibly and in good faith.

In accordance with WIRED’s policies, I am disclosing that I used generative AI to draft bureaucratic emails and update my tracking spreadsheet as part of this report. I wrote the body of this article mainly by hand in my scratch notebook.

One of the first errors came from Crunchbase, known for its database about tech startups. I emailed my access request to its privacy address on August 17. My message laid out the rights I wanted to exercise and included a direct request not to erase anything: “I am not requesting deletion at this time. Please do not treat this as a deletion request.” I received a reply two days later from a Crunchbase support representative.

“Thanks so much for your patience. Your account has been permanently deleted from Crunchbase. Please let me know if you need anything else!” the message read in full.

I followed up via email almost immediately, reiterating that I wanted data access, not data deletion. “Your Crunchbase user account was deleted. Other data located on Crunchbase was not deleted,” read the follow-up support response explaining what happened. If I wanted to have a Crunchbase account, I would have to reregister.

When I reached out to Crunchbase for comment, a spokesperson blamed the mistake on a “processing error” and said that the company would proceed with my original access request as filed. The spokesperson also claimed the misclassified response came from “a person on our customer success team” and not a generative AI tool.

My interactions with BeenVerified, a searchable database that gathers public records, also encapsulate my friction-filled experience placing these access requests.

I emailed BeenVerified’s dedicated CCPA compliance address on the morning of August 19. It laid out that I was a California resident placing an access request, not a deletion request. You’ll never guess what happened next.

Two days later, I received a message from a BeenVerified support representative about removing information. “It appears your person report has already been removed from our Person Search results,” read its initial response. “In addition, we have removed the requested phone number and email address from our search results. This change should be reflected within 24 hours.” Not at all what I asked it to do.

When I sent my next email explaining that I had submitted an access request, not a deletion request, the support representative followed up 15 minutes later, denying my claim and saying the company couldn’t verify my identity. That was perplexing, since it located some of my details earlier in the message thread and didn’t even attempt to explain what I might need to share for verification.

At my wit's end, I sent another email explaining how confused I was feeling by these responses. “Please be assured that we're able to process your opt-out request and have removed your information from our website,” read the support representative's response. If I wasn’t already bald, I would have pulled out the rest of my hair at that moment.

I found solace in chatting with an academic researcher who had previously helped place access requests with over 500 data brokers under the same California law and also encountered multiple misclassifications. “Sometimes I would make an access request, and the automatic answer was ‘We will opt you out’ or ‘We will delete your data,’” says Elina van Kempen, a PhD student at UC Irvine and coauthor of Consumer Beware! Exploring Data Brokers' CCPA Compliance. While some data brokers followed up with corrections, other times the researcher was left without any resolution.

When I reached out to BeenVerified for comment, Greg Hammond, senior counsel and senior director of compliance at its parent company, claimed via email that support agents receive annual privacy training, including how to process CCPA requests. “Unfortunately, despite the training, the agent who handled this matter was mistaken and misunderstood the request type,” he wrote. Hammond says the company now plans to provide refresher training on correct processing and to audit recent work.

My attempts to place an access request with Cash App, a money-sending service offered by Block, were equally frustrating, even without a deletion mistake. The company’s privacy policy, in bold, states that California residents can place access requests through Cash App’s website or by a toll-free phone call. I opted to test out the phone number.

The first time I called and explained that I was a California resident who wanted to place an access request, it was as if I had started speaking in a language from outer space. I was placed on hold multiple times before being told to check the privacy policy and call the number listed there, which I had just done to get to this point. My attempt to process an access request over the phone was being effectively denied.

“OK, sure, I'll call this number right back,” I said before I hung up, a bit of anger bubbling up in my voice despite my best efforts to remain professional. My interactions with the next customer support agent were similarly burdensome. After being put on hold, I was asked to call back later so the support team would have more time to review their resources and understand how to handle my call.

“Customers can access or delete their personal information directly through Cash App, which allows us to more quickly verify identity before providing access to financial account information or deleting an account,” a Cash App spokesperson wrote over email when I reached out for comment. “Our phone support teams are trained to help customers understand how to submit these requests, and we also provide customers with instructions they can access through our online Help Center."

The spokesperson did not respond to follow-up questions asking why the phone number was explicitly listed in Cash App’s privacy policy as a way for consumers to exercise their data rights.

Experts I spoke with questioned whether companies are putting in enough effort to be legally compliant. “It shows how potentially little resources the companies are putting toward compliance and making sure that people can have access to their data,” says Mayu Tobin-Miyaji, a law fellow at the Electronic Privacy Information Center.

Both Winters and Tobin-Miyaji mentioned a beefed-up approach to “data minimization” as a potential better path forward for consumers. This would essentially mean companies can collect only the data they need to process standard business operations. For example, saving your credit card information in the app for future purchases might be allowed, but collecting personal demographic information to sell to brokers might be blocked.

Data minimization is a more holistic approach that shifts the burden away from consumers, who are currently forced to navigate a bureaucratic obstacle course just to see what companies know about them. Instead, by limiting what companies can collect about you in the first place, consumers can have more peace of mind without going through the headache-inducing process I endured.

This story originally appeared on wired.com.

Read full article

Comments

A new identity theft service launched on the dark web this week is selling digital scans of more than 153 million drivers licenses from people in the United States and Canada. Based on interviews with individuals whose licenses are available for purchase on this service, it appears to be siphoning images collected by a widely-used identity verification company based in Louisiana. KrebsOnSecurity also has learned that the New Orleans field office of the Federal Bureau of Investigation (FBI) today launched an official inquiry into the source of the images.

On Monday, Aug. 31, a source alerted KrebsOnSecurity to a service advertised by a new user on the Russian cybercrime forum Exploit, offering access to digital scans of identity documents on more than 170 million people in North America. The source brought it to my attention because the proprietor of this identity theft service offered my Virginia drivers license as a free sample in their initial sales thread on Exploit.

The service, dubbed Nexus, claims to have more than 153 million drivers licenses for people in the United States and Canada, as well as more than 10 million identification cards; more than three million travel documents and/or international IDs; and at least 579,000 medical cards.

A quick look around Nexus finds they are likely not exaggerating about that 153 million number: Running a blank search in Nexus (with no search parameters entered) returns approximately 11.5 million pages of results, with roughly 15 results displayed per page. It includes documents from people in both Canada and the United States, but the bulk of these records are on Americans: searching for just Canadian drivers licenses returns approximately 1.1 million results, with the largest concentration from Ontario (473,673 records).

Curiously, the identity records include not only drivers licenses but also marijuana dispensary cards. Some of the records list their “source” as “CDL,” presumably short for “commercial drivers license.” Other records carry the source notation of “CAC,” which may refer to Common Access Cards, government issued identity cards that grant physical access to government buildings and secure rooms.

The people behind Nexus claim the license images are coming from an active breach at “a major identity verification company” whose customers include multiple Fortune 500 companies.

“We have been continuously exfiltrating new data for over a year into our private database,” the service enthused in its introductory post on Exploit. “Records are available to preview before purchase with pertinent information redacted. Customer photos are displayed if available.”

Indeed, over the past 24 hours, the number of drivers license records listed as available in Nexus has increased by nearly 400,000, suggesting that freshly stolen license data is being harvested and uploaded to this service on a semi-regular basis.

The record that features my drivers license includes six image files — three pairs of photos of the license’s front and back — a basic image scan — as well as infrared and ultraviolet versions of the same images. A date and timestamp is appended to each image file, and the timestamp on my license scan corresponds to a date in June 2025 when I took a flight to the midwest United States to attend a family funeral.

Intent on discovering the source of this data, KrebsOnSecurity asked more than a dozen friends and family members for permission to search for their licenses in this service. Each person whose license could be found (nine of them) confirmed having traveled on or very close to the dates in the timestamps attached to their images. It is unclear what timezone these timestamps are in, but from reviewing car rental records shared by several people who helped with this research, it appears the timezone is set to Greenwich Mean Time (GMT).

At first, I thought the source of the data might have something to do with airports. However, that theory went out the window when it became apparent there were no passports in this data set. Also, only some of those who helped with this research said they showed their drivers license at the airport on the day of their travel. One person whose license was in Nexus hadn’t flown at all recently, but was renting a car from Hertz for several months around the date of their timestamp.

Two of those who agreed to help are federal employees who said they shared other forms of government identification when passing through airport security. However, those individuals each said they shared their state-issued drivers licenses later that day when renting vehicles at their respective destinations, and that both rented their cars from Hertz.

After finding a note in my calendar for the day of my June 2025 flight reminding me to bring my passport, I remembered that I also never actually shared my drivers license when I went through security at Reagan National Airport on that day because I did not yet have a Real ID, a security-enhanced drivers license that is now required by the Transportation Security Administration (TSA) for all domestic travel. Instead, I showed the TSA agent my government-issued U.S. passport.

Here’s where it gets interesting: I was able to find my mother’s drivers license in this service as well, and the timestamps for her images are just a few seconds apart from mine. That’s notable because we both handed our licenses to the Hertz rental car representative at the same time.

According to my mom, the only place she gave her drivers license to that day was the rental car company, and if memory serves that is also true for me. I don’t recall if the rental car representative inserted our licenses into any kind of machine, but I remember they held onto them for several minutes behind the counter while we were signing various forms. KrebsOnSecurity sought comment from Hertz and will update this story in the event they reply.

Zach Edwards is a well-known security and privacy researcher who recently launched a service called DecryptAds to help people better understand how online advertisers are tracking them. A scan of Edwards’s drivers license is available for purchase on this identity theft service, and Edwards said the timestamp on his record corresponds to the middle of a trip last month to Las Vegas for the annual DEFCON security conference.

Edwards told KrebsOnSecurity that although he did not rent a car in Vegas, he did hand over his license at the TSA checkpoint, at a marijuana dispensary in Vegas, and at his hotel (the Aria). But he said the only one of those three that for sure scanned his ID in some kind of device was the dispensary.

Edwards said the dispensary he visited that day was Planet13, a multi-state chain with stores in California, Florida, Illinois and Nevada. In 2022, the New Orleans-based identity provider idscan.net published a press release announcing an exclusive identity verification agreement with Planet13’s dispensaries nationally. IDScan says it processes ID verification for more than 1,000 marijuana dispensaries in 19 U.S. states.

The “trust” page of idscan.net states that the company provides identity verification services for numerous big brands, including Hertz, Target, Fedex, Motorola Solutions, the financial services giant Jack Henry, and Caesars Entertainment. And as idscan.net’s own documentation states, the technology scans IDs with both infrared and ultraviolet light. Idscan.net says the company’s systems and technology perform more than 21 million verifications monthly, at more than 20,000 locations around the world.

Contacted by KrebsOnSecurity, idscan.net said it was investigating the matter, but the company has not yet shared an official statement or a substantive reply to specific questions sent via email.

“At this point I’m not able to share any additional information, but the updates you have provided have been welcome, and helpful to our team’s investigation,” wrote Jillian Kossman, a marketing and operations leader at idscan.net.

During the course of my research for this story, word got around to the FBI that I was poking at the apparent source of this new identity theft service’s data. Probably they were tipped off when I shared with a trusted source that Nexus also is selling the drivers license information for the assistant director of the FBI (I did not find FBI Director Kash Patel’s license in Nexus).

Earlier this afternoon, I was added to a conference call with a half-dozen FBI agents, including senior leaders from the agency’s cyber division. During that call, the FBI shared that earlier today their New Orleans field office opened an official investigation into an apparent breach involving idscan.net.

Edwards said that as more in-person and online experiences require sharing drivers licenses, vendors who collect this sensitive data need to be held to a higher standard.

“This episode should further strengthen the resolve for people who are fighting back against online ID schemes which are requiring countless providers to ask for drivers licenses in order to access services under the guise of protecting kids,” Edwards told KrebsOnSecurity. “These systems are putting sensitive data into more and more 3rd party vendors, and we don’t have nearly the oversight to ensure they are safe.”

Larry Baldwin is principal intelligence researcher at the cybersecurity firm Cybera. Baldwin said a front and back scan of his drivers license available at Nexus contains timestamps that correspond to the date of a car rental from Hertz on a recent vacation.

Baldwin said the Nexus identity theft service presents multiple serious security and privacy threats, noting that state-issued drivers licenses are commonly used as proof of one’s identity when opening new lines of credit. Baldwin said the service could also dangerously expose many people who do not wish to be found but who cannot meaningfully change their appearance (or at least not enough to fool today’s AI-based image matching tools).

This category of people, he said, includes those fleeing domestic violence, and even people who have been assigned a whole new life and identity as part of the federal government’s witness protection program, which is generally reserved for criminal defendants in racketeering and conspiracy investigations who agree to cooperate with federal authorities.

“Just when it seems like we’re making some headway in improving authentication controls through drivers license verification systems, this happens and the very thing those improvements are dependent on are compromised,” Baldwin said.

Update, 8:56 p.m. ET: Shortly after this story was published, the Nexus identity theft service website vanished from the darkweb, replacing its login page with a plain text message that reads, “This service is no longer available.”

This is a potentially fast-moving story. Any changes or updates will be noted here along with a timestamp.