Crane

every link you share from X (Twitter), Instagram, YouTube, TikTok and Spotify snitches on you. and this is f*cking insane: on X the person you send it to can read what phone you're on, right there in the link. copy any X (Twitter) post on your iPhone and look at the end. ?s=46. that number means iPhone. send it through WhatsApp and it turns into s=48. Telegram, s=52. Android is s=19. anyone who gets that link can see it. and that's the part you can see. the rest is tied to your account: → X (Twitter) ?t= / ?a= → a token linked to whoever shared it → instagram.com ?igsh= → a share id tied to your account → youtube.com ?si= → connects the click back to you → open.spotify.com ?si= → same thing → tiktok.com ?sender_device= → even says if you were on a phone or a pc every link you drop in a group chat sends a little trail back to you. and no, you can't just delete everything after the ?. do that to a YouTube link with a timestamp and it breaks. so i had Claude Code Opus 5.5 build a cleaner that knows the rules for each platform. paste any link and it shows what's hidden in it, strips the trackers, keeps what the link needs to work. 12 platforms plus any other site. runs in your browser, sends nothing anywhere. bookmark button and an iPhone shortcut included, so links get cleaned right from the share sheet. free and open source, link in the reply. paste the last link you sent someone and see what it says about you

my AirPods kept connecting on their own, so last night i plugged in my iPhone and let Claude Code Opus 5.5 dig through the whole account. it found someone had been listening to me through those AirPods, and the switch that let them do it was sitting in my settings the entire time. here's what tipped me off. my iPhone was face down on the desk and the orange dot was on. the little dot iOS shows when the mic is live. no app open, screen off, dot on. it happened twice before i stopped ignoring it. so i had Opus 5.5 audit the account instead of the phone. every device signed into my Apple ID, every accessibility feature that can reach the mic, and the Live Listen settings. → there was a device on my account i didn't recognize. an old iPad name i never use → Live Listen was set up. it turns the phone into a mic that streams to AirPods over bluetooth → Remote Control was ON. that lets another device on the same account, within range, start a listening session and read the live captions that's the whole thing. no malware, no hack. someone had added their device to my Apple ID months ago, and as long as they were close enough, they could turn my phone into an open mic and watch the words scroll by. it only works at bluetooth range, so this was someone near me. that made it worse, not better. what i did, four minutes: → Settings, tap my name at the top, removed every device i didn't recognize → changed the Apple ID password, turned on two-factor → Control Center, Hearing icon, turned Remote Control off → checked which apps hold mic access and cut the ones that don't need it the orange dot hasn't come on since. if you ever see that dot with nothing open, don't brush it off. check who's on your account first. bookmark this.

TikTok, Instagram and Meta are listening to your conversations. that's what everyone says. last week i stopped guessing and checked. i was on a call with a friend and said i was thinking about breaking up with my girlfriend. didn't text it. didn't search it. just said it out loud with my phone on the table. two hours later she opens TikTok next to me and her whole feed is breakup videos. "signs it's over." "how to heal." she looked at me and asked why TikTok was showing her this. i didn't have an answer. so i sat with my iPhone plugged into my PC until morning, running Claude Code on all three apps. mic access, background activity, where the targeting actually comes from. and what it found wasn't what i expected. here's what it found: no app was recording my conversations. not TikTok, not Instagram, not Meta. iOS logs every time the mic turns on and shows a dot on screen when it does. there was no secret stream. the "phones listen" thing is not how it works. what's actually happening is worse, because you can't turn it off by denying one permission: → my girlfriend's phone and mine were on the same wifi, so the ad networks treat us as one household → her searches and mine get linked through that shared network and our contact graph → i'm in her contacts, she's in mine, and that alone ties our ad profiles together → data brokers sell "people seen together" as a signal → so when i talked about a breakup and she half-searched it later, the system had enough to point the feed at both of us the feed didn't need the mic. it had our location, our wifi, our contacts and our searches, and that's plenty. then i had Claude Code map every permission and build a cleanup. what i did: → revoked microphone from every app that doesn't need it to work → revoked location from apps set to "always," dropped them to "while using" or never → turned off "allow apps to track," this kills the cross-app ad ID → turned off "nearby interactions" for apps that don't need it → reset the advertising identifier within a few days the feed stopped feeling personal. not because i muted a mic, but because i cut the links the targeting was actually using. the full step by step and the prompt are in the first reply. takes about 5 minutes. bookmark it and send it to the next person who swears their phone is listening.

while Claude Code was reverse-engineering my router, it found a privacy problem i didn't expect. my internet provider can reach into my router settings remotely and i never agreed to it. and my provider logs every site i open, in plain text. how it went: → plugged my laptop into the router on windows 10 → sent Claude Code a photo of the router sticker → "read every setting on my router, back it up first, change nothing" → 40 seconds later it had the whole config in a file → "now show me anything that leaks my data or lets someone in from outside" here's what it flagged: my router keeps a list of 29 devices that ever joined my wifi, with the time each one first connected. my provider has a remote management channel into the router. it's a hidden protocol called TR-069, and on a provider box you usually can't turn it off yourself. my DNS lookups went out unencrypted, so my provider has a log of every domain i visited. not the pages, the sites. the provider app on my TV box kept sending data while the TV was off. and it's bigger than me: TR-069 remote management sits on hundreds of millions of routers (University of Innsbruck looked at how secure it is). researchers pulled 2 billion+ router locations out of Apple's wifi database, accurate to a few meters (University of Maryland, 2024). how to fix yours: 1. send Claude Code a photo of your router. it finds the admin page and reads every setting first, before touching anything 2. change the admin password from the one printed on the sticker 3. turn on encrypted DNS (DoH), your provider stops seeing your lookups 4. turn on Private Wi-Fi Address on your phone so it stops showing its real hardware ID to every network 5. add _nomap to the end of your wifi name, Google and Apple drop it from their location maps i put all of this into a free checklist you can run on your phone in 10 minutes. it ticks off each step, saves nothing, sends nothing anywhere. link in the reply. bookmark it so you don't lose it, and run it on your parents' router too, theirs is probably still on the sticker password.

Claude Code Opus 5.5 caught three strangers inside my Netflix, HBO Max and Spotify. Warsaw, Istanbul, Lagos. they'd burned through 40 hours of my stuff in two months and the Lagos one was 5 minutes from finishing a doc i'd been saving. the TV tipped me off. Netflix opened on a Turkish crime drama dubbed into Polish. the red on the logo looked off, warmer than usual. told Opus to pull auth logs from everything with a card on file. Netflix, HBO Max, Prime, Apple TV, YouTube Premium, Spotify. last 30 days. flag anything that isn't mine. four seconds later: Netflix → 3 sessions. Prague (me), Istanbul (?), Warsaw (?) HBO Max → 2 sessions. Prague (me), Lagos (?) Prime Video → clean Apple TV → clean Spotify Family → 4 members. i added 2. Warsaw was watching the Turkish drama right then. Istanbul had finished a second season i never started. Lagos had the Mariupol documentary paused at 42:11. how they got in: a Czech VPN provider dumped credentials in August. my Netflix password was in there. i'd rotated the bank one that week. not Netflix. device fingerprints: attacker 1 → Windows 11, pl-PL panel, Warsaw residential IP attacker 2 → Android 14 TV box, tr-TR, Istanbul attacker 3 → macOS 14, en-NG, Lagos mobile Spotify was the weird one. one of the two strangers i hadn't added had been building a jazz playlist for 6 months. soft stuff. the kind you put on at 4am when you can't sleep. told Opus to kick everyone. rotate every password. 2FA where it exists. fresh recovery emails on an alias i've never used. the sessions dropped one by one. the TV went dark, came back on the Netflix sign-in screen like we'd never met. set a cron. same check every Sunday. wake me only if there's a stranger. three strangers. two months. 40 hours of my taste in things. one jazz playlist i almost kept. if you've reused a Netflix password from 2022, run the check tonight. the Lagos guy had 5 minutes left.

Claude Code caught spyware on my 18 y/o sister's phone. Been running for 10 weeks before we noticed Her phone kept dying by 2pm. Pocket-warm with the screen off. She figured it was just worn out What tipped her off was that people kept knowing where she'd been. Not guessing, knowing Plugged the phone into my laptop, opened a terminal, gave Claude Opus 5.5 a single prompt: scan every running process, hidden ones included, flag anything she didn't install herself Under 2 minutes: → 63 processes alive → 60 clean → 2 old games still pinging her location in the background → 1 app named "Device Health", no icon anywhere, not in any store What "Device Health" was holding: → accessibility service, read everything on her screen → full photo and file access → mic, location, every SMS → device admin, so she physically couldn't uninstall it → scheduled upload every 15 minutes, 3am included Then I had Opus tear the app apart Decompiled in 4 minutes. What was inside: → every new photo copied and shipped out within 60 seconds → full gallery already exfiltrated, 2,300+ photos gone → keylogger catching every keystroke → screenshots triggered the moment she opened Instagram or her bank → GPS written to a log every 5 minutes Zipped and shipped to one server, 3 times per hour Still queued when we caught it: 847 screenshots, 112 fresh photos Opus pulled the receiver details: reports to → +1 (415) *** **72 carrier → T-Mobile US last ping → 40.7**, -73.9** · 2 min ago This wasn't a system app. Someone put it there by hand. She doesn't know who. Doesn't know when We archived everything the app had recorded, handed it off to people who do this for a living, then nuked it, rotated every password, turned on 2FA across the board Battery went from dead at 2pm to 40% by 10pm Your 3-minute check tonight: battery → if something drains with the screen off, that's a signal photos → only your camera and gallery apps need "all photos" accessibility → any app in there you can't explain shouldn't be device admin → "Find My Device" is the only one that belongs no-name apps → missing icon + "system", "health", "sync" in the name → open it Found something? Don't tap delete yet. Screenshot the permissions, the storage, the install date. Then remove it and rotate passwords from a different device Save this. Check your phone tonight. Then check your family's Prompt below ↓

HIDDEN GEM ON GITHUB 📈 mixelpixx/Konnect +228 stars in 24h ⭐ 1.2k total ⭐ claude can design circuit boards now. konnect is a kicad 10 plugin that gives your AI 228 tools over MCP it places parts and wires the schematic, lays out and routes the PCB in real time, runs ERC and DRC checks, and exports gerbers, BOM and pick-and-place files ready for the fab it even searches a local catalog of 2.5M JLCPCB parts for stuff that's actually in stock, and starts from reference circuits like USB-C, buck converters and STM32 smart detail: loading all 228 tools would eat ~23K tokens, so it starts with a ~2K starter kit and pulls the rest on demand single rust binary, ~9 MB download. still beta, so check every board before you order it bookmark it if you've ever spent a weekend routing traces by hand