Worst of Cybersecurity Reporting

Two tech reporters, Yael Grauer and David Huerta, return for their fifth annual roast of cybersecurity journalism, this time limited to print articles about privacy and surveillance. They open with a "best smartphones" piece that mixed marketing claims with no clear methodology, which made it hard to tell what was actually being compared.

The middle of the session moves through a range of stories. A security researcher's personal app choices were presented as general advice, ignoring different threat models. A cryptographic attack on SSH affected only a handful of unusual implementations but was framed as broadly alarming. Juice jacking has stayed a proof of concept for years, and a Flipper Zero article claimed intelligence agencies feared a power grid attack without much evidence. A Canadian espionage story leaned on claims without supporting detail, and a Gmail verified-badge article put the burden on users rather than the vendor. The burner phone guide missed identifiers such as the IMEI and recommended a six-digit passcode that forensic tools can crack.

The closing advice is practical: add context, treat single sources and police claims with skepticism, put missing evidence high in a story, and avoid blaming users for flaws companies should fix. For researchers, the speakers suggest explaining the real conditions behind a proof of concept, since a working demo is not the same as a practical attack.