CC14: Worst of Cybersecurity Reporting 2025

Cybersecurity headlines often turn hypothetical attacks, recycled leaks, and misunderstood technology into risks that sound more immediate than the evidence supports. huertanix and Yael Grauer return for their annual review of security and privacy reporting. They examine 2025 stories about Tor, juice jacking, Signal, password leaks, ESP chips, burner phones, unsubscribe links, and a New York-area SIM farm. The roast also offers practical guidance for reporters, editors, security researchers, and sources who want coverage to reflect real-world risk and technical context. Stories and lessons covered: Why Tor is a protocol and network rather than a platform that controls dark-web content How proof-of-concept juice jacking became broad advice about public charging Signal funding narratives and the difference between metadata and message content Old credential collections presented as a new 16-billion-password breach Physical-access research, undocumented chip functions, and misuse of the term backdoor Threat modeling burner phones, unsubscribe links, SIM farms, and encrypted messaging 00:00 Introduction 01:45 How the annual reporting roast works 02:56 Recurring cybersecurity media tropes 03:17 Misunderstanding Tor and the dark web 06:04 Hypothetical juice-jacking risks 08:47 Signal funding and CIA conspiracy claims 12:10 Repackaging old password leaks as new 13:46 ESP chip functions mistaken for backdoors 14:46 Naming targeted security researchers 15:43 Burner phones, travel phones, and location data 18:19 Fear of email unsubscribe links 20:16 The New York SIM-farm story 25:28 Lessons for journalists and editors 27:16 Lessons for security researchers 27:53 Closing remarks #CactusCon #Cybersecurity #TechJournalism #Privacy #MediaLiteracy