Worst of Cybersecurity Reporting

Yael Grauer and David Werza return with their yearly review of security and privacy journalism, this time covering news stories from 2025. They limit the review to news articles rather than marketing, PR, TV coverage or social posts, and they stress that disliking one story does not mean the author or outlet is bad. Many of the stories share a pattern: old or hypothetical threats presented as urgent.

The middle of the talk walks through specific examples. A dark web story treats Tor like a platform that can be policed, when it is a protocol and network. Juice-jacking research, which was a proof of concept, became broad advice against public charging, even though no such attacks have been documented in the wild. Signal coverage treated funding and cloud hosting as scandals, and a subpoena was reported as if it revealed something new, when the government already had the phone number. Other pieces include a "16 billion passwords" breach that was an old dump repackaged as new, undocumented ESP chip functions described as backdoors, a news outlet publishing the names of researchers targeted by a hacking group, burner phone guides that ignore location data and hardware identifiers, and warnings that unsubscribe links are dangerous. The talk also examines a New York-area SIM farm whose threat to cell service was overstated.

The closing advice is aimed at two audiences. Journalists should add context early, avoid daily publishing quotas that encourage shallow work, build sources who will challenge their premises, and verify official claims. Security researchers should separate real-world risk from hypothetical risk, use terms like backdoor precisely, and take part in public discussion.