Light

Episode #1073 Quiz

The FCC Bans New Consumer Routers
Date: 2026-04-07 | Length: 2.5 hrs | Episode page at twit.tv

About this episode

Security Now! episode 1073 details LinkedIn’s covert browser extension scanning via a 2.7MB JavaScript bundle, collecting device fingerprints and probing for 6,000+ extensions, violating privacy and potentially GDPR. It critiques the FCC’s abrupt ban on foreign-made consumer routers, arguing it lacks targeted risk analysis, legal rigor, and ignores firmware update needs, risking greater insecurity.

Your name and email are stored only in your browser local storage for convenience. They are not retained server-side.

NameEmail

Question 1: What is the main functional difference between traditional browser fingerprinting and Microsoft's 'super-fingerprint' method as used by LinkedIn's Spectroscopy scanning?

Question 1

What is the main functional difference between traditional browser fingerprinting and Microsoft's 'super-fingerprint' method as used by LinkedIn's Spectroscopy scanning?

Traditional fingerprinting allows third parties to track users across multiple domains, but Microsoft's method prevents cross-site tracking by design. Traditional fingerprinting encrypts each data point separately, whereas Microsoft's method uses a one-way hash function. Traditional fingerprinting aggregates device data into an irreversible hash, whereas Microsoft's method encrypts and retains all raw data for later decryption. Traditional fingerprinting collects only browser extensions, while Microsoft's method collects only hardware information.

Question 2: According to the episode, what key criticism does the Technology Policy Institute make about the FCC's 2026 ban on new foreign-made consumer routers?

Question 2

According to the episode, what key criticism does the Technology Policy Institute make about the FCC's 2026 ban on new foreign-made consumer routers?

The FCC's ban applies equally to all devices regardless of actual security risk, but it allows unrestricted new router imports. The FCC implemented the ban rapidly without deliberative processes, public comment, or a cost-benefit analysis, resulting in a broad, legally weak measure. The FCC focused too narrowly on only Huawei and ZTE routers, ignoring other vulnerable manufacturers. The ban only targets router software vulnerabilities and ignores hardware-based supply chain risks.

Question 3: What is the main security architecture improvement of Cloudflare's EmDash CMS over WordPress as described in the episode?

Question 3

What is the main security architecture improvement of Cloudflare's EmDash CMS over WordPress as described in the episode?

EmDash plugins have unrestricted direct access to the database and filesystem like WordPress plugins. EmDash runs each plugin in an isolated sandbox (Dynamic Worker) with explicitly declared permissions, limiting plugin capabilities. EmDash requires all plugins to be licensed under the WordPress GPL license to ensure open source compatibility. EmDash eliminates plugins altogether to improve security, offering only built-in features.

Question 4: Based on the episode, what is the critical difference in treatment between previous FCC bans on Huawei/ZTE equipment and the 2026 ban on all foreign-made consumer routers?

Question 4

Based on the episode, what is the critical difference in treatment between previous FCC bans on Huawei/ZTE equipment and the 2026 ban on all foreign-made consumer routers?

The Huawei/ZTE bans required companies to onshore manufacturing, while the router ban does not have any conditional approval process. Huawei/ZTE bans were targeted and included regulatory processes; the router ban is a broad category ban implemented without public comment. The router ban specifically exempts all American brands regardless of manufacturing origin, whereas Huawei/ZTE bans did not. Huawei/ZTE bans allowed new models while the router ban only restricts updated firmware.

Question 5: Regarding LinkedIn's Spectroscopy scanning, which of the following statements about the data collection and transmission is accurate as per the episode?

Question 5

Regarding LinkedIn's Spectroscopy scanning, which of the following statements about the data collection and transmission is accurate as per the episode?

Users are explicitly notified on each LinkedIn visit about the device scanning and must consent to the JavaScript running. LinkedIn's JavaScript probes for thousands of browser extensions, collects extensive device info, encrypts it, and attaches a persistent fingerprint to all API requests during a session. The collected data are irreversibly hashed before transmission, preventing Microsoft from reconstructing the original device info. LinkedIn only collects extension presence data without combining it with device hardware information to preserve privacy.

Cancel

My Data//Security & Privacy//Clear Local Data

© 2026 Ken ArmstrongSecurity Now™ is a trademark of TWiT LLC. All trademarks and copyrights of the Security Now podcast are respected and reserved to their respective holders.
This is a hobby project made with love and admiration for what Steve Gibson and Leo Laporte have built over 20 years.