Episode 269 - Eighteen Billion and a Bedtime Meta Settlement, Claude Watermark Trace Buster Buster, Cookie Fort Knox
PEBCAK Podcast: Information Security News by Some All Around Good PeopleShow Notes
Welcome to this week's episode of the PEBCAK Podcast! We’ve got four amazing stories this week so sit back, relax, and keep being awesome! Be sure to stick around for our Dad Joke of the Week. (DJOW) Follow us on Instagram @pebcakpodcast
Please share this podcast with someone you know! It helps us grow the podcast and we really appreciate it!
Simple 6 signup link
Meta buys its way out of the teen engagement lawsuit and writes the curfew into the settlement. https://www.bleepingcomputer.com/news/technology/meta-agrees-to-18-billion-settlement-over-teen-social-media-harms/
Meta settled with 52 attorneys general for ~$18B over claims Facebook and Instagram were built to drive compulsive teen use, resolving a 2023 suit led by California AG Rob Bonta that also alleged illegal under-13 data collection under COPPA. The product terms are the real story: a default two-hour daily cap for under-18s that only a parent can lift, a midnight–6am blackout, notifications muted 10pm–7am and during school hours, hidden like counts, no cosmetic surgery filters, and expanded age verification to find under-18s and purge under-13s — locked in for ten years under an independent auditor. Only $12.7B goes to states now. The other $5.3B is held back until YouTube and TikTok adopt matching one-hour limits, nighttime restrictions and age assurance, and each makes a matching payment — at which point Meta's own cap drops to one hour. Meta openly framed this as driving industry-wide adoption. Read that again: Meta just put a $5.3B bounty on its competitors adopting mandatory age verification, and everyone's calling it a punishment. Meta books ~$10B in Q3 legal expenses; California takes $1.5–2.1B.
A watermark-removal industry sprang up overnight for a watermark nobody can detect. https://www.bleepingcomputer.com/news/security/ai-watermark-removers-flood-the-web-almost-none-can-prove-they-work/
Days after Anthropic switched on invisible watermarking in everything Claude writes, a removal market appeared: a 4,500-star GitHub project, freshly registered domains like claudewatermark[.]rip and gptcleanup.com, and existing Turnitin-bypass shops (StealthGPT, Human Writes) bolting Claude onto their pitch. None of it is verifiable; Anthropic hasn't published the scheme or shipped a detector. The technical punchline: stripping zero-width characters and C2PA/EXIF metadata works, but it's trivial, since file metadata dies on a re-save or a screenshot. The real mark lives in which words the model picked, so the only known removal is a heavy rewrite through a second model. Guillaume Meyer, who wrote the biggest tool, says so himself, metadata only, for now. Tester Pasquale Pillitteri read the code instead of the READMEs and found one popular cleaner passed a hidden payload through intact. Driver is EU AI Act Article 50, enforceable since Aug 2, penalties to €15M or 3% of global turnover. And a detected mark only proves Claude touched the text, not that it wrote it. Defender angle: these ship as agent skills people wire into pipelines and feed documents through. That's a supply chain surface.
Chrome finally kills the infostealer's favorite trick: the stolen cookie that walks past your MFA. https://arstechnica.com/security/2026/08/chrome-adopts-what-may-be-the-best-protection-yet-against-account-takeovers/
Chrome shipped device-bound session credentials, storing a key in the device's security chip: TPM on Windows, Secure Enclave on macOS and iOS and cryptographically binding session cookies to that hardware. A stolen cookie can't be replayed on the attacker's box to walk past MFA, because the private key never leaves the chip. This is the fix for the failure mode we keep covering: as users adopted 2FA and passkeys, infostealers stopped fighting the login and started lifting the post-auth session instead. Announced in 2024, beta in April, GA for Workspace on Chrome for Windows from May 25, on by default with no admi
More from PEBCAK Podcast: Information Security News by Some All Around Good People
Before you can sell software, you have to sell yourself. After every Sales Engineer interview panel, the team asks one question: if we had to drive three hours together to a customer meeting, would the time fly by or would it feel like a root canal? Chapter 3 of Sales Engineering, Unfiltered covers how to pass the windshield test and the rest of the SE interview loop. In this chapter:
Welcome to this week's episode of the PEBCAK Podcast! We’ve got three amazing stories this week so sit back, relax, and keep being awesome! Be sure to stick around for our Dad Joke of the Week. (DJOW) Follow us on Instagram @pebcakpodcast
A compliance-heavy customer, a quarter-end deadline, and a stock answer from the knowledge base that wasn’t going to cut it. Chris spun up a proof of concept on his own credit card and walked the customer through it live. Six months later, that account expanded into the largest commercial deal in company history.
Welcome to this week's episode of the PEBCAK Podcast! We’ve got four amazing stories this week so sit back, relax, and keep being awesome! Be sure to stick around for our Dad Joke of the Week. (DJOW) Follow us on Instagram @pebcakpodcast
Year one, a big enterprise prospect, and a 30-slide deck nobody asked for. Thirty minutes in, the CISO stopped Chris cold, and that night a bar napkin became his first real discovery framework. Chapter 1 of Sales Engineering, Unfiltered introduces the three voices behind the book and the lessons they wish someone had handed them on day one: