America's Most Secure Cellphone Service (https://nitter.cf/t.co/KgeWAAAUe9)
San Francisco, California
Joined January 2012
- Tweets3.9K
- Following6
- Followers9.3K
- Likes2.7K
Your vibecoded app works today... One future update could break it!
Our GM, Mark Kreitzman, warns about returning to modify an application after AI has lost important development context.
If you don’t understand the architecture, you may miss what the change breaks.
Watch Mark explain the risk to @perezcarreno on The Web Talk Show.
Full conversation in the next post. 👇
What happens when AI no longer has the context behind your code?
Watch @efani GM Mark Kreitzman’s full conversation with @perezcarreno on The Web Talk Show:
youtube.com/watch?v=H-h8GFIj…
⚠️ He lost $24 million to a SIM swap. Eight years later, hackers came after his old numbers.
@michaelterpin says attackers acquired his former phone numbers after they were released - and immediately tried to hack him again.
He had strengthened his security. This time, he says their access was limited to old Microsoft Office files.
Your old number deserves a place in your security plan.
Watch him explain what happened on @efani’s Features Podcast. Full conversation below. 👇
Watch @michaelterpin and Mark Kreitzman discuss the $24M SIM swap, lessons from being targeted again, and protecting digital assets on the Efani Features Podcast:
youtube.com/watch?v=EwQLY72O…
🚨 $6.36 BILLION. MOST OF IT MOVED IN ABOUT 20 MINUTES. Even the world’s largest #crypto exchange could not keep attackers out.
An attacker drained @binance wallets across 10 blockchains on October 29, according to TRM Labs, which attributes the attack to North Korea’s TraderTraitor group with high confidence.
TRM calls it the largest crypto theft on record, roughly FOUR TIMES the $1.5 billion Bybit hack.
Binance initially pointed to a potentially compromised DevOps engineer’s laptop. Investigators have since found additional breach points. The full attack path remains under investigation.
Binance estimates the impact at approximately $6.3 billion, says around $3 billion has been frozen, and promises to cover all losses. Withdrawals have been suspended.
Your exchange password can be strong. Your phone can be updated. Your account can have MFA. You still depend on the security of systems you cannot inspect or control.
Treat every platform holding your money or identity as a potential point of failure. A familiar app and a trusted brand do not eliminate that risk.
Binance has begun recovering affected assets for users and continues to work with law enforcement, issuers, blockchain intelligence firms and industry partners to trace, freeze and recover additional funds.
The company has already publicly committed to cover losses through company funds in the prior announcement.
Binance has already reserved over $6.34B of company funds to cover this incident. $5B of these funds are already held in the exact token assets that were impacted. We are completing the purchase of the remaining amount by buying token assets through market channels and OTC channels. We are doing this to match the format of the remaining token assets and address any asset shortfalls. This step can take longer because some tokens may have low liquidity and OTC settlement also takes time. We will share more progress as soon as we can.
These figures do not include frozen or protected assets, which remain subject to ongoing recovery and verification. Currently, $3bn has been frozen, with thanks to our industry partners. We are working with partners and law enforcement to recover the frozen assets.We will continue to use company resources to cover confirmed shortfall and will provide further verified updates as recovery efforts progress. Ultimately, all user funds will be verified publicly through our Proof of Reserves.
We will weather this storm. Thank you for the support.
For executives and high-value crypto holders, a phone number tied to account recovery deserves serious protection.
Use passkeys or hardware security keys where supported. Secure your recovery email. Ask your carrier how it blocks SIM swaps and unauthorized number transfers.
For enterprises, review privileged access, isolate signing systems and require independent withdrawal approvals.
At @efani, our focus is protecting the phone number tied to your accounts. That protection is one layer; exchange infrastructure needs its own defenses.
Your AI-built website could be exposing the keys to your business.
Our GM, Mark Kreitzman, describes finding TWO exposed API keys in his own deployment after letting AI connect to his hosting platform.
An app can work perfectly while leaving sensitive credentials publicly accessible.
Watch Mark explain the discovery to @perezcarreno on The Web Talk Show - and why it changed his workflow.
Full interview in the next post. 👇
Watch the full conversation on AI development and cybersecurity with @efani GM Mark Kreitzman and @perezcarreno on The Web Talk Show:
youtube.com/watch?v=H-h8GFIj…
Why crack a secure phone when you can force its owner to unlock it?
Modern phone security can make guessing your way into a device extremely difficult. But encryption cannot prevent someone from threatening the person who knows the PIN.
In this clip, Deniable founder Josh Thomas joins Efani’s Mark Kreitzman to explain how hardware-backed protections restrict guessing; and why physical coercion presents a different challenge.
Watch Josh explain the human risk behind secure technology. Full interview and Deniable website in the next post. 👇
How do phones restrict PIN guessing - and what changes when someone pressures the owner to unlock one?
Watch Josh Thomas and Mark Kreitzman:
youtu.be/WQ8vnYbrXrU
Learn about Deniable:
deniable.io/
⚠️ Your health searches, purchases and private interests can end up in an advertising profile about you. Much of the tracking happens where you never see it.
Location, contacts, photos and activity across services can expose far more about your life than you intended to share. The FTC has documented extensive surveillance by major social media and video platforms.
The attached video alleges that popular apps secretly record conversations and store keywords. The supplied material does not establish that claim. An AI-generated analysis needs evidence before anyone calls it proof.
You should still audit what these apps can access. A familiar logo is no reason to hand over your entire photo library, precise location or address book.
On iPhone:
• Open Settings → Privacy & Security.
• Review Microphone, Camera, Photos, Contacts and Location Services.
• Enable App Privacy Report to see recent access and contacted domains.
It starts collecting after activation and covers seven days.
Your phone number can help unlock your financial accounts. @Google’s Gemini could soon help manage the eSIM behind it.
An emerging SIM Manager integration lists five capabilities:
- Set up a new eSIM.
- Convert a physical SIM to an eSIM.
- Transfer a cellular profile onto a new phone.
- Restore an eSIM profile from a Google cloud backup.
- Delete an active eSIM profile.
That could make replacing a broken phone or switching devices easier. It also puts an AI assistant closer to operations that affect your mobile service and access to incoming verification codes.
The feature is still emerging. Its listed capabilities do not establish that every operation works end to end, and this discovery does not demonstrate a security vulnerability.
The listed restrictions matter, too. Gemini cannot view carrier call logs, change billing plans, or enable an already installed eSIM. Transfers must begin on the destination device.
Before this reaches more users, Google needs to make the authorization process clear. What requires a device unlock? What requires carrier approval? What confirmation appears before deletion or transfer?
Those safeguards deserve as much attention as the convenience.
For executives, journalists, public figures and crypto holders, losing control of a number can expose incoming private communications and help an attacker target accounts tied to it.
Privacy protection therefore includes controlling who can move your mobile service.
If cloud restoration becomes available, scrutinize how it verifies ownership. A backup option alone does not prove that access to a Google account is enough to restore someone’s eSIM.
Protect your Google account with a passkey or security key, review recovery methods, and keep recovery codes somewhere you can access without your phone.
Enterprise security teams should evaluate assistant-driven eSIM management before approving it on work devices.
Require clear user confirmation, strong authentication for transfers, and a recovery process for employees who unexpectedly lose service. Check whether your device-management tools can restrict the integration.
For privileged accounts, use phishing-resistant MFA and review any SMS recovery fallback.
At @efani, our position is straightforward: easier eSIM management should preserve strict controls over who can transfer a number.
Ask your carrier which protections cover SIM changes and which cover port-outs. Verify both!