#HarmBlock
LightNews LightNews
alecmuffett.bsky.social
IF YOU DO NOTHING ELSE TODAY: please read this astonishing summary of what Paul Moore has been doing to #SafeToNet, #HarmBlock & the Government-lauded #HMDFuse kids’ phone
https://alecmuffett.com/article/166501
#OnlineSafetyAct
IF YOU DO NOTHING ELSE TODAY: please read this astonishing summary of what Paul Moore has been doing to #SafeToNet, #HarmBlock & the Government-lauded #HMDFuse kids’ phone
Every online generation has at least one overhyped, disastrously implemented “great white saviour” safety app that turns out to be atrocious. Now comes: HarmBlock+ World’s Safest …
alecmuffett.com
September 23, 2026 at 9:45 AM
uglygame.bsky.social
Last month, I spoke to Paul Moore, a security researcher about his investigation into the HMD Fuse, what government favourite SafeToNet called "the world's safetest phone." He has now published as detailed security review, which makes for shocking reading.
paul.reviews/harmblock-wo...
World's Safest Smartphone: Please Rotate Responsibly.
An independent review of the HMD Fuse, marketed as the World's Safest Smartphone.
paul.reviews
September 22, 2026 at 12:43 PM
sophieehill.bsky.social
Security consultant Paul Moore found that he could silently connect to *any* HMD Fuse device, access the child's live GPS location, and even turn off the Harmblock+ protections.

Hard to imagine a more serious set of security failures on a device that has safety *as its USP*.

x.com/paul_reviews...
Paul Moore - Security Consultant  (@Paul_Reviews) on X
PSA: Multiple Critical HMD Fuse / #HarmBlock+ Vulnerabilities Over the past seven months, I've responsibly disclosed multiple critical security vulnerabilities affecting the HMD Fuse and HarmBlock+ p...
x.com
August 23, 2026 at 2:08 PM
sophieehill.bsky.social
Important to note that Moore says these security failures do not come from the SafeToNet software Harmblock AI but from HMD's Harmblock+.

A good demonstration that your security and privacy protections are only as strong as your weakest link!
Clarification: The HMD Fuse embeds HarmBlock Al, developed by @SafeToNet. Despite the similar names, HarmBlock Al and HarmBlock+ are different products. The vulnerabilities l've disclosed relate to HMD's HarmBlock+ implementation and surrounding platform, not SafeToNet's HarmBlock Al technology. These findings do not indicate any weakness in HarmBlock Al itself.
August 23, 2026 at 2:08 PM
sophieehill.bsky.social
It is an *astonishing* failure of due diligence that two UK government ministers - Jess Phillips and Peter Kyle - have appeared in videos endorsing SafeToNet Ltd and its untested technology.

www.linkedin.com/posts/safeto...
UK Safeguarding Minister backs SafeToNet's HarmBlock to prevent online child abuse | SafeToNet posted on the topic | LinkedIn
Jess Phillips UK Safeguarding Minister says of SafeToNet's #HarmBlock, “We are on a journey where this becomes completely standardised. Not because big tech companies have seen the writing on the wall...
www.linkedin.com
July 8, 2026 at 3:31 PM
sophieehill.bsky.social
NEW: Retailers have reportedly removed the "safe smartphone" made by HMD + SafeToNet after critical security vulnerabilities were found – including exposing a child's GPS location 🤯

HUGE questions to answer for Jess Phillips + Peter Kyle for their promotion of SafeToNet...

x.com/paul_reviews...
Paul Moore - Security Consult... X.com @Paul_Reviews The #HMDFuse should not return to market. Nobody Paul Moore - Security Consult... @Paul_Reviews X.com PSA: Multiple Critical HMD Fuse / #HarmBlock+ Vulnerabilities Over the past seven months, I've responsibly disclosed multiple critical security vulnerabilities affecting the HMD Fuse and HarmBlock+ platform to HMD and Xplora. Those reports have now resulted in the platform being taken offline. During my research, I was able to: • Silently pair with any HMD Fuse device, anywhere in the world, assume the role of the parent/guardian, access the child's live GPS location, remotely manage installed apps, and disable all HarmBlock+ protections. • Emulate any HMD Fuse device, allowing arbitrary device data to be uploaded and presented to the parent/guardian application. • Remove all HarmBlock+ protections entirely by factory resetting the device using Google's Find My Device or a standard ADB command, despite the platform being marketed as "deeply embedded into the OS" and "cannot be bypassed or uninstalled." HMD has notified the UK Information Commissioner's Office (@ICOnews). However, affected users have not been informed of the nature or impact of the incident. Instead, the app simply states the service is unavailable due to "maintenance and security upgrades." Based on my findings, these vulnerabilities were present from the product's launch and affected the platform's core security model. In my opinion, they created a significant risk to children's privacy and safety and render the product unfit for its intended purpose. Whilst I commend HMD for taking the platform offline, I believe parents deserve a clear explanation of what happened, what
August 23, 2026 at 12:55 PM
drogersuk.bsky.social
This product should not be on sale: paul.reviews/harmblock-wo...

#childsafety #productsecurity #mobile
World's Safest Smartphone: Please Rotate Responsibly.
An independent review of the HMD Fuse, marketed as the World's Safest Smartphone.
paul.reviews
September 23, 2026 at 9:34 AM
creativeboom.com
How a collective of independent creatives built the HarmBlock brand 👀 www.creativeboom.com/inspiration/...
April 19, 2025 at 2:03 PM
uglygame.bsky.social
Recently, I wrote a piece on SafeToNet based on security researcher Paul Moore's work, showing that the only phone using its software was so unsafe it was withdrawn.

This evening, Paul has posted a video appearing to show that the underlying harmblock software fails in the most basic way.
September 9, 2026 at 5:39 PM
heatherburnstech.bsky.social
Apologies for screen caps from the hell site, but
Paul Moore - Security Consultant @Paul_Reviews I must admit, it's been really difficult to remove emotion from this research project. Very long story short, anyone can track your child's live GPS location, enable/disable apps, send/receive messages/calls and disable ALL protection mechanisms remotely - including Harmblock Al. Much like the #EU #ageVerification app, this wasn't a complex "hack" or sophisticated attack. The technology is fundamentally broken by design and despite my best efforts, I can't convince #HMD to take appropriate action and pull the plug. Harmblock Al by @SafeToNet represents genuine & much-needed progress in this sector; efforts which are tainted by irresponsible companies who seemingly care not for #security or #privacy in any meaningful way. I have genuinely tried everything over the last 7 months; from multiple in- person meetings, late night group calls & lengthy technical discussions with all involved. Regrettably, the only responsible next step is a detailed post-mortem so parents/guardians can make an informed decision. I'm equally disheartened to see @jessphillips and @peterkyle promoting this, seemingly without a moment's due diligence. At the same time, @Ofcom continues to pursue foreign companies beyond their jurisdiction for unenforceable fines under the guise of child safety. It's truly farcical. I would kindly ask for your help in raising awareness. 0... Paul Moore - Security Consultant y @Paul Reviews PSA: Multiple Critical HMD Fuse / #HarmBlock+ Vulnerabilities Over the past seven months, l've responsibly disclosed multiple critical security vulnerabilities affecting the HMD Fuse and HarmBlock+ platform to HMD and Xplora. Those reports have now resulted in the platform being taken offline. During my research, I was able to: • Silently pair with any HMD Fuse device, anywhere in the world, assume the role of the parent/guardian, access the child's live GPS location, remotely manage installed apps, and disable all HarmBlock+ protections. • Emulate any HMD Fuse device, allowing arbitrary device data to be uploaded and presented to the parent/guardian application. • Remove all HarmBlock+ protections entirely by factory resetting the device using Google's Find My Device or a standard ADB command, despite the platform being marketed as "deeply embedded into the OS" and "cannot be bypassed or uninstalled." HMD has notified the UK Information Commissioner's Office (@ICOnews ). However, affected users have not been informed of the nature or impact of the incident. Instead, the app simply states the service is unavailable due to "maintenance and security upgrades." Based on my findings, these vulnerabilities were present from the product's launch and affected the platform's core security model. In my opinion, they created a significant risk to children's privacy and safety and render the product unfit for its intended purpose. Text copied from image Whilst I commend HMD for taking the platform offline, I believe parents deserve a clear explanation of what happened, what information may have been affected, and what steps they should take. A detailed analysis is coming soon. Clarification: The HMD Fuse embeds HarmBlock Al, developed by @SafeToNet. Despite the similar names, HarmBlock Al and HarmBlock+ are different products. The vulnerabilities l've disclosed relate to HMD's HarmBlock+ implementation and surrounding platform, not SafeToNet's HarmBlock Al technology. These findings do not indicate any weakness in HarmBlock Al itself. H+ HARMBlock+ PROTECTION (ACTIVE) BUILT TO PROTECT YOUR KIDS HMD Fuse with HARMBlock+ Protection SECURE. PROTECTED. TRUSTED. Advanced protection for your family. 11:28 AM • Jul 20, 2026 • 4,864 Views HACKED SYSTEM BYPASSED. ALL DATA EXPOSED. HYD ALL PROTECTION MECHANISMS DISABLED AI CONTENT FILTERING WEB & APP CONTROLS CALL & CONTACT SAFETY SCREEN TIME & SCHEDULES PAIRING RESTRICTIONS LOCATION SAFETY GPS COORDINATES PHOTOS & VIDEOS MESSAGES & FILES APP USAGE & ACTIVITY DEVICE INFORMATION ANYONE. ANY DEVICE. ANYWHERE. ANYTIME. X DISABLED DISABLED DISABLED DISABLED DISABLED EXPOSED EXPOSED EXPOSED EXPOSED EXPOSED EXPOSED CAN PAIR NO LIMITS ANYONE CAN PAIR. ANY DEVICE. ANYWHERE. They can become the guardian, monitor your child, and track their every move in real-time. HYD HMD FUSE Protected with HARMBlock+ H+ AI CONTENT FILTERING Blocks harmful content WEB & APP CONTROLS Safe browsing & app limits LOCATION SAFETY bua rotan location sharing PARENTAL CONTROL You stay in control 060000
July 22, 2026 at 12:31 PM
uglygame.bsky.social
Security researcher Paul Moore found that HMD's implementation of HarmBlock - confusingly called HarmBlock+ - incorporated other software and could be almost immediately compromised.

HMD patched the failings he identified.
5/
August 24, 2026 at 3:57 PM
risu.bsky.social
paul.reviews/harmblock-wo...

As ever “safe tech for kids” is rarely safe, but it does make people a lot of money
World's Safest Smartphone: Please Rotate Responsibly.
An independent review of the HMD Fuse, marketed as the World's Safest Smartphone.
paul.reviews
September 23, 2026 at 2:22 PM
sophieehill.bsky.social
SafeToNet makes HarmBlock software that allegedly stops nudity from being shot, shown, or stored. They partnered with Fuse to create a "child safe smartphone": the #HMDFuse.

www.hmd.com/en_gb/hmd-fu...
HMD Fuse | The phone that grows with your kids
A smartphone that puts your child’s online safety first, but this is no dumbphone. Guardians can manage apps remotely, and AI content filter blocks nudity.
www.hmd.com
August 23, 2026 at 1:41 PM
harmblock.com there’s harmblock the vendor that pushed for this which seems to just always be scanning everything on screen
Homepage
harmblock.com
June 8, 2026 at 1:13 PM
owenboswarva.bsky.social
Guardian journos will presumably be seeking comments from Jess Phillips MP and Peter Kyle MP for their latest position on HMD's Harmblock + SafeToNet

Any day now
August 23, 2026 at 4:37 PM
uglygame.bsky.social
When the HMD Fuse came out with HMD's HarmBlock+ embedded, Moore found he was able to easily compromise that too.
6/
The key selling point of SafeToNet’s software is that, because it’s embedded in the OS, its software ‘cannot be bypassed or uninstalled’ and yet, in just an hour, Moore was able to remove all the HarmBlock+ protections on the Fuse. He was then able to ‘assume the role of the parent/guardian, access the child’s live GPS location and remotely manage installed apps.’ And by ‘assume the role of parent/guardian,’ Moore means that he would have been able to take over any Fuse phone anywhere in the world with ‘absolutely no sign to the parent.’
August 24, 2026 at 3:59 PM
uglygame.bsky.social
Two weeks ago, I reported that the CEO of SafeToNet, the government's favourite tech company, claimed that "God has created the safest phone in the world" and that only after finding God did SafeToNet become "fully funded" and the software properly work.

This week, some FAQs have appeared...
1/
Q: Is SafeToNet linked to any religious or political movement, and if so, does that shape how the technology decides what counts as harmful? A: No. SafeToNet is not linked to any religious or political movement, and no religious or political position influences how HarmBlock decides what counts as harmful. The SafeToNet team is made up of people of all faiths and none, working together toward a single shared aim. Keeping children safe online is a moral mission, not a religious one, and it's one that people arrive at from a wide range of personal beliefs, experiences and backgrounds. What HarmBlock is built to detect and prevent is defined by child safety standards and by working with recognised child protection expertise
July 29, 2026 at 10:57 AM
owenboswarva.bsky.social
Lisa Nandy's statement on protecting children online www.gov.uk/government/s...

The UK Government is doubling down on device-level censorship despite the HarmBlock/SafeToNet debacle

#techpolicy #childrights #openweb
Since June, officials from my department and the Home Office have overseen an unprecedented work programme with Apple and Google, working with senior leaders and engineers to explore new ways of preventing child sexual abuse and strengthening protections for children online. I can report that - following this engagement - Apple and Google have provided the government with significant commitments. Both companies have developed meaningful changes at the operating-level to make it harder for children to share nude imagery, we have seen progress in the blocking – not blurring – of nude imagery on underage devices, and this builds on significant milestones already in implementation - Apple's recent rollout earlier this year of operating-system level age assurance tied to safety features, preventing a child from receiving or sharing nude imagery on iMessage or Facetime.
September 8, 2026 at 3:44 PM
uglygame.bsky.social
This is the SafeToNet HarmBlock software that government ministers (Jess Philips, Peter Kyle) did video promos for in January and that prompted the government in June and again yesterday to mandate that all phones must have similar software installed at an OS level.
September 9, 2026 at 5:43 PM
sophieehill.bsky.social
BBC News allowed SafeToNet founder Richard Pursey to promote his company's Harmblock technology under the guise of a "news" segment.

As far as I can see, there has been no independent testing or verification of this software. How does it work? How accurate is it? What are the privacy implications?
Screenshot of Richard Pursey appearing on BBC News, embedded in linkedin post
July 8, 2026 at 4:22 PM
jbambury.bsky.social
Which explains nothing of how this would actually work in practice.

Seems the proposed solution here is HarmBlock. Is the legislation to force US tech companies to embed this? Will it be illegal for parents to give their child a phone without it?

There's one phone on sale with it which is £542
May 12, 2026 at 3:38 PM
uglygame.bsky.social
Moore is clear that the fault with HMD's implementation of HarmBlock doesn't imply that SafeToNet's HarmBlock is flawed, but he questions why the company, which positions itself as focused on child safety, didn't better vet its partner and its product.
9/
August 24, 2026 at 4:03 PM
sophieehill.bsky.social
Security consultant Paul Moore has found that the HMD Fuse has "multiple critical security vulnerabilities".

His judgement is clear: "The #HMDFuse should not return to market"

x.com/paul_reviews...
One message to @VodafoneUK's #CEO was all it took. Within hours of the disclosure to Mr Taylor's team, the HMD Fuse/#Harmblock+ device appears to have been pulled from Vodafone & Three. It's disappeared from Mozillion too, for reasons unknown. This is what #responsibleDisclosure looks like when a company's commitment to #ChildSafety is genuine rather than a marketing line. Vodafone deserve enormous credit for how they handled this. Swift, decisive, no legal obstruction. One of the most straightforward disclosures I've been involved in; the new yardstick to which all others will be compared. The #HMDFuse should not return to market. The #HMDFuse should not return to market. Nobody involved in building it appears to have asked the most basic questions about whether it actually safe, not even the then Secretary of State for #DSIT, @peterkyle or @jessphillips - who claimed it was "proven technology" whilst testing the vulnerable device. #HMD's own website still has it advertised at a £50 discount, yet the platform has been offline since July 8th. Thanks to everyone who raised awareness with retweets/quotes.
August 23, 2026 at 1:41 PM
samvimes6.bsky.social
I heard about Harmblock for the first time today.
It's an OS level AI that the UK government are trying to force companies to install by default that blocks nudity by default unless you prove your age.
The UK Gov announcement is heavy on the "think of the children"...
www.gov.uk/government/n...
New plans to stop children taking, sharing or viewing nude images
Britain will become the first country in the world where it is impossible for children to take, share or view naked pictures on their devices.
www.gov.uk
June 18, 2026 at 6:46 AM
uglygame.bsky.social
Here is Paul's explanation. In basic terms, in his testing, Paul found the HarmBlock software can be defeated on the display of unsuitable images by rotating the phone. About the lowest bar possible and the software apparently couldn't clear it.
Paul Moore - Securit... @Paul Reviews There's a very detailed write-up coming soon, but the fragility of the "safest children's phone in the world" / #HarmBlock on the #HMDFuse can be demonstrated in one short video. The #Al model is 94.4% confident that this image is #NSFW Open it in Files & hold the phone in portrait: blocked. Rotate it landscape and that confidence level drops to 4.3% and the "harmful" image appears as normal. Alternatively, open it in Photos instead. This is the technology cited as "a proven example" that on-device protection is not only possible, but should be integrated into every device, by law. Stay tuned
September 9, 2026 at 5:42 PM