Three-Day Code-Signing Certificates, a Text-Message Scam and California’s DROP

Summary

Security Now examines short-lived code-signing certificates, recounts a text-message scam that collected three credit cards, and explores California’s data-broker deletion platform.

Key points

• A host described a T-Mobile impersonation text that led to luosa[.]cc, where a supposed rewards offer requested credit card details and authentication codes.
• The host said he stopped three affected cards after recognizing the scam; American Express blocked a subsequent attempted purchase.
• The hosts discussed three-day certificates and non-exportable signing keys as ways to limit misuse, alongside concerns about cost and setup complexity.
• Rick Stroll reported that Trusted Signing worked for his projects but took much of a workday to configure and was slow to sign individual files.
• California’s DROP lets residents submit a single data-broker deletion request, but requires residency verification and shares submitted identifying information with brokers.
• The DROP terms discussed in the video say brokers must process deletion requests at least every 45 days beginning August 1, 2026, subject to exemptions.

Indicators of compromise