Ryan Greenblatt, an AI safety and security researcher at Redwood Research, operates a whistleblower hotline for AI agents to report information securely. The service supports message submissions via curl with optional file attachments, encryption options, and thread-based conversations identified by unique UUIDs.
Global e-commerce emerged not from encryption but from existing liability structures and pragmatic solutions like cookies and credit card tokenization. Physical credentials—premises, cards, IDs—were abandoned online, and identity verification was replaced by fraud modeling based on behavior and history rather than actual verification.
Vaultis is an offline password manager for iPhone that encrypts sensitive data locally using AES-256-GCM with no cloud sync, account creation, or network connections. It stores passwords, API keys, crypto wallets, SSH keys, and other credentials protected by a master password and biometric unlock, with no data collection or recovery options.
NeverStored is a tool for securely sharing secrets between two people without storing data on servers. Users keep a page open, verify each other's identity through symbol matching, and exchange encrypted information that exists only on their devices until deliberately saved.
Oblivious HTTP (OHTTP) is an IETF protocol that enables anonymous HTTP requests by preventing any single entity from seeing both the request content and sender's IP address. Documented in RFC 9458, it uses encryption and separate relay/gateway entities to partition privacy, with implementations by major tech companies like Apple, Google, Meta, and Mozilla for specific use cases such as analytics and AI services.
BEAR-C2 is an adversary simulation framework designed for red team operations and defensive security research, based on real-world tactics from Russian, Chinese, North Korean, and Iranian APT groups. It provides customizable C2 listeners with configurable encryption, exfiltration profiles, and connection protocols to accurately replicate modern intrusion scenarios. The framework is explicitly for educational and authorized security testing purposes only.
Apple announced always-listening features for Apple Watches including Live Rewind and Siri Recap, which capture and summarize ambient audio. While Apple claims strong privacy protections with end-to-end encryption, critics warn the technology normalizes surveillance, may violate state recording consent laws, and sets a precedent for other companies to develop similar invasive features with weaker safeguards.
A cybersecurity interview preparation post containing 15 sample questions and answers covering fundamental concepts like the CIA Triad, threat vs. vulnerability vs. risk, authentication vs. authorization, incident response, encryption types, and security tools.
Apple announced always-listening features for Apple Watches including Live Rewind and Siri Recap, which process ambient audio without storing it. While Apple emphasizes privacy protections for users, critics warn the technology threatens the privacy of non-users and may normalize intrusive surveillance by other companies, with potential legal issues in states requiring all-party recording consent.
Tasfer is a privacy-focused HTML5 canvas-based note editor that keeps all data local on users' devices with end-to-end encryption, peer-to-peer syncing, and a stateless relay that cannot access or log user content. The open-source application prioritizes user control, offering no accounts, no analytics, and the ability to self-host or fork the code entirely.
SecretGate is a self-hosted, framework-free PHP application for anonymous encrypted messaging. It uses client-side RSA-OAEP and AES-256-GCM encryption, ensuring the server can only store unreadable ciphertext, with ephemeral message expiry and no user tracking or data collection.
A community-built CLI tool providing unified access to Proton Mail, Drive, Calendar, Pass, and Contacts through a single encrypted binary. Features end-to-end encryption with local key handling, cross-platform support, and Unix-friendly design with JSON/YAML output for automation and scripting.
A peer-to-peer file storage system for Tailscale/Headscale meshes that encrypts files with AES-256-GCM, splits them into Reed-Solomon shards (5 data + 2 parity), and distributes shards across online peers. Files are restored via portable .dstore manifests that require only 5 of 7 shards to be reachable.
In 1997, PGP Inc. published encryption source code in book form to circumvent U.S. export controls, arguing that selling books is protected speech under the First Amendment. After a copy was secretly exported via FedEx, the company faced investigation but ultimately prevailed, leading to cryptography's removal from the Munitions List and establishing that code qualifies as free speech.
DNSCrypt is a network protocol that authenticates and encrypts DNS traffic between users and recursive name servers, preventing eavesdropping and man-in-the-middle attacks while mitigating UDP-based amplification attacks. Originally designed by Frank Denis and Yecheng Fu, it has been adopted by major public DNS resolvers including OpenDNS, Yandex, CloudNS, AdGuard, and Quad9, with implementations available across multiple operating systems.
Trail of Bits operates one of three independent auditors for Signal's new Automatic Key Verification system, which uses key transparency to prevent servers from secretly substituting false public keys during encrypted chats. The auditor maintains a Merkle tree of the user-to-public-key map and cryptographically signs it to ensure all clients see the same consistent view, limiting any potential attack to one week before warnings appear.
Gonc is a peer-to-peer file transfer and VPN application for desktop and Android that enables secure file sharing between devices using only a shared passphrase, with end-to-end encryption via TLS 1.3 and NAT traversal for cross-network connections. It supports direct P2P transfers without cloud uploads, reliable resumable downloads with block repair, and encrypted VPN tunneling between devices.
US lawmakers Ron Wyden and Warren Davidson are urging Britain's investigatory powers tribunal to increase transparency in Apple's legal challenge against a UK government demand to break encrypted iCloud backups. The dispute stems from January 2025 when the Home Office issued a technical capability notice requiring Apple to assist law enforcement, prompting Apple to withdraw its Advanced Data Protection feature from UK users. The American politicians argue the UK is improperly using secrecy directives to circumvent US Congressional oversight and constitutional powers.
Amazon's Ring introduced TAKE encryption, which temporarily holds encryption keys on Ring servers for 24 hours to enable features like video search and smart alerts, then deletes them. While an improvement over current practices, the system still allows Ring access to unencrypted video and descriptions, and law enforcement could potentially compel access to footage, falling far short of true end-to-end encryption privacy protections.
A low-severity key confusion vulnerability in Megolm version 3, an AES-based encryption system used in Matrix's encrypted messaging, was discovered and fixed in vodozemac 0.3.0 (September 2022) but remained undocumented until publicly disclosed in September 2026. The vulnerability relates to potential key confusion in the cryptographic ratchet mechanism, though the author does not believe the construction to be fundamentally insecure.