标签：#Privacy

Every developer has done it — copy-pasted a JWT, a private key, or a JSON blob with sensitive data into some random website and held their breath. Wondering if it was being logged, tracked, or worse. Every developer has done it — copy-pasted a JWT, a private key, or a JSON blob with sensitive data into some random website and held their breath. Wondering if it was being logged, tracked, or worse. I built KRUMB.DEV because I wanted tools that didn't make me feel dirty after using them. What Is It? 46 developer tools, all in one place. No signup. No uploads. No tracking. Open source. The terminal-inspired interface isn't just aesthetic — it's a constraint. Every tool fits in a single column, zero sidebar, zero popups. Just you and the tool. What's Inside Formatters — JSON, SQL (17 dialects), HTML, JavaScript, CSS Encoders — Base64, URL, JWT decoder, YAML↔JSON, JSON↔CSV Generators — Passwords, UUIDs (v1/v3/v4/v5), hashes (MD5/SHA/HMAC), QR codes, Lorem Ipsum, color palettes, CSS gradients/shadows/grids, meta tags, robots.txt, .gitignore Testing & Debugging — Regex tester, diff checker, webhook tester, cURL→code, HTTP status reference, cron expression builder Converters — Unix timestamps, hex↔RGB, binary, SVG→JSX, JSON→TypeScript, HTML playground, markdown editor Network — DNS lookup, SSL checker, IP lookup, QR code decoder, IBAN validator Why I Built It This Way Most "free" dev tools follow the same pattern: create an account, hit a rate limit, and wonder if your data is being stored somewhere. KRUMB.DEV flips that: Everything runs in your browser — JSON, JWT, source code, passwords never touch a network request Zero accounts — open the page, use the tool, leave. No signup wall between you and the output Clean interface — ⌘K opens a command palette to jump to any tool in seconds Open source — MIT license, deploy your own if you want The Tech Next.js, TypeScript, and Tailwind. Static-first, client-side execution for all core tools. Server routes exist only for DNS/SSL l

According to Mark Gurman, Apple is planning to reveal its first smart glasses at WWDC next June, with an expectation that they'll launch by the end of 2027. Part of the hold-up may be around the company's efforts to get its privacy features and messaging in order. Smart glasses in general, and Meta's in particular, […]

The government is prosecuting US citizen Sam Tunick for allegedly providing authorities with a "duress password" that wiped his phone when they tried to seize it at Atlanta's Hartsfield-Jackson airport on January 24th, 2025. Federal agents detained Tunick at the airport, allegedly questioning him about child exploitation images. However, a motion filed by Tunick's lawyers […]

TL;DR: We checked Halonyx — our self-hosted E2EE messenger implementing X3DH + Double Ratchet — against the EU's Chat Control, US EARN IT Act, India's IT Rules 2021, the UK's Online Safety Act + Investigatory Powers Act, and the UN Cybercrime Convention. Here's the honest answer for each. When you implement end-to-end encryption from scratch, you spend a lot of time thinking about cryptographic threat models. Key substitution attacks. OPK exhaustion. WebRTC IP leakage. The adversaries you model are largely technical. At some point, you have to model a different kind of adversary: the legal one. We built Halonyx — a self-hostable E2EE messenger implementing the Signal Protocol (X3DH key exchange, Double Ratchet, Safety Numbers, WebTorrent P2P file transfer). The server architecturally cannot read your messages — not by policy, but because it holds no decryption keys and no plaintext. We wrote a STRIDE threat model across 17 attack surfaces. We did not write a legal threat model. So we did. This is what we found across five jurisdictions. None of this is legal advice. All of it is current as of July 2026, in a policy landscape that is actively moving. Quick Architecture Recap Before the jurisdiction breakdown, a one-paragraph recap of what Halonyx actually does, because the architecture is what determines the legal exposure. The relay server stores and forwards only AES-256-GCM ciphertext. It holds no private keys, performs no cryptographic operations on behalf of users, and has no mechanism to identify message content or originators. User identity is a pseudonymous 256-bit USID — the server stores only SHA-256(USID) . Files transfer peer-to-peer via WebTorrent; the server receives only a magnet URI. This architecture — which we call Federated Relay Architecture (FRA) — is what creates the legal situation described below. 1. European Union — Chat Control / CSAR Current status: No conflict with anything currently in force. The EU's Child Sexual Abuse Regulation (CSAR),

Most journaling and mental wellness apps require syncing sensitive personal thoughts to cloud servers where they risk being mined or exposed. I wanted a space where user data never leaves the browser. So I built Sanctuary — a lightweight, local-first reflection vault. 🛠️ Technical Highlights 100% Local-First: All entries and app states stay strictly inside browser local storage. Zero tracking scripts or analytics. Resonance Diagnostics: Dynamic, client-side SVG visualizations mapping baseline mood trends over time. Therapy PDF Export: Uses native CSS print styling ( @media print ) to generate clean offline summary reports for check-ins without sharing app access. Zero Overhead: Blazing fast load times with no database or cloud sync latency. Check out the live app: sanctuaryb.lovable.app I'd love feedback from the dev community on the local storage architecture, baseline algorithms, or visual UI!

A U.S. citizen has asked a court to throw out the government's claim that he gave over a passcode to border authorities that wiped his phone's data, opening up fresh questions about a person's constitutional rights at the U.S. border.

Many online image converters require users to upload their files to a remote server before processing. For ordinary images this may be acceptable, but for personal photos, screenshots and documents, privacy becomes an important concern. I built a lightweight online image converter that processes images directly in the browser. It currently supports: JPG PNG WebP HEIC GIF SVG BMP TIFF Why browser-based processing? The main goal was to make image conversion simple, fast and privacy-friendly. Because the conversion happens locally: Images are not uploaded to a server Users do not need to create an account There is no installation process Network upload time is avoided Private files remain on the user’s device The basic workflow is simple: Select an image Choose an output format Convert the file Download the result Challenges Browser-based image conversion still has some limitations. Different browsers support image formats differently, especially formats such as HEIC and TIFF. Large images may also consume more device memory during processing. Some format features may not be preserved after conversion. For example, transparency may be lost when converting to JPG, and animated images may become static depending on the selected output format. These limitations need to be handled through clear prompts and error messages.

Introduction Polymarket , and on-chain prediction markets like it, kept bothering me for one reason. Polymarket |世界最大の予測市場™ Polymarketは世界最大の予測市場であり、さまざまなトピックにわたって将来のイベントを取引することで、最新情報を入手し、知識から利益を得ることができます。 polymarket.com Who bet on what is visible in near real time. The moment a whale places a big bet on one outcome, everyone watching piles in behind them, and the odds move accordingly. That's not manipulation — it's just what happens with a public ledger. But it doesn't satisfy the simple wish to not reveal your prediction before everyone else does. So: could you build a prediction market that keeps your pick hidden until voting closes? To find out, I built Hidden League Forecast on Midnight , a privacy-focused blockchain. It's an MVP where you just guess the winner of a fictional soccer league (the World Cup just ended, so soccer was on my mind). Note What's a prediction market? A mechanism that expresses predictions about future events as prices. Think "which team will win the World Cup match," for example. If you want to learn more about prediction markets, this resource (Japanese) is a great start: https://zenn.dev/barabara/books/prediction-markets-structure The backend is written in Compact , Midnight's smart contract language. Note It combines the commit-reveal pattern with zero-knowledge proofs so that "the content of your prediction stays hidden, while only the aggregate stake becomes public." In this article, I'll walk through the contract code, showing what stays hidden and what becomes public at each step. Note This app runs on testnet. Demo Video After connecting Lace Wallet, you see your Shielded Address and balance. From here you can deploy a new market or enter an existing contract address to join one. The Overall Flow What's actually happening is simple. OPEN → REVEAL → AWAITING RESULT → RESOLVED → CLAIM Connect Lace Wallet, then deploy a market or join an existing one Pick one of 4 teams (Amber Foxes / Cedar Owls / Harbor Whales / Meadow Bears) and

In October 2017, researcher Mathy Vanhoef published an attack that broke WPA2, the encryption that had protected almost every Wi-Fi network on the planet for over a decade. The surprise was how it worked. KRACK did not guess your Wi-Fi password or brute-force any key. It tricked your device into installing a key it had already used, and that single mistake unraveled the encryption. WPA2 replaced the badly broken WEP standard in 2004 and quickly became the baseline for wireless security. For thirteen years it held up well. The passphrase-based version most homes use (WPA2-Personal) was vulnerable to offline password guessing if you chose a weak passphrase, but the protocol itself was considered sound. KRACK, short for Key Reinstallation Attack, was different. It targeted a flaw in the WPA2 standard itself, which meant every correct implementation was affected. The four-way handshake, briefly When a device joins a WPA2 network, the client and the access point run a four-message exchange called the four-way handshake. Both sides already share a secret (derived from the passphrase or from an enterprise authentication server). The handshake uses that shared secret to agree on a fresh session key, the Pairwise Transient Key, that will actually encrypt the traffic for this session. The important part is message three. The access point sends message three to tell the client the key is ready, and the client responds with message four and installs the key. Once installed, that key encrypts frames using a counter, called a nonce or packet number, that increments with every frame. The security of the encryption depends on one rule: a given key must never encrypt two different frames with the same nonce. The reinstallation trick Wi-Fi is a lossy medium. Messages get dropped. So the standard says that if the access point does not receive message four, it retransmits message three. When the client receives a retransmitted message three, it reinstalls the same key and, critically,

MSG’s sprawling surveillance system can monitor guests down to the second. Its owners made an exception for the pop star’s rehearsal dinner.

Letting a stranger contact a car owner without giving them the number There is a small, very common problem in Indian cities that turns out to be a surprisingly good systems design exercise. A car is parked badly. It is blocking a gate, a driveway, another car. Someone needs the owner to move it, right now. The traditional fix is a phone number written on a sticker on the windscreen. That works. It also means a stranger — any stranger, forever — has the owner's personal number. Why the sticker is worse than it looks Once a number is visible on a windscreen, a few things follow: It gets scraped. Numbers on vehicles end up in marketing lists. It cannot be revoked. Change your number and every sticker you own is now wrong. It has no context. A 2am call could be a genuine emergency or someone who saw the number three months ago. It is a safety issue for some owners in a way it is not for others. A number attached to a vehicle, at a known parking spot, at predictable times, is more information than most people realise they are publishing. So the requirement is oddly specific: a stranger must be able to reach the owner, immediately, without ever learning how to reach them again. That constraint is what makes this interesting. The naive version, and why it fails First instinct: put a QR code on the vehicle that opens a page with a "call owner" button, and put the number behind the button. This solves nothing. The number is still in the page source. Anyone who wants it can get it, and now you have added a scan step for the honest majority while stopping none of the dishonest minority. Second instinct: put a contact form behind the QR. The stranger types a message, the owner gets a notification. Better on privacy, useless in practice. The person needs the car moved in the next ninety seconds. They are not filling in a form and waiting for an email. If the fast path is not there, they go back to writing an angry note. The real requirement is synchronous contact with asynchron

The next time you’re locked out of your Google account, you can use your face as part of the account recovery process.

Sending a photo feels simple. You choose an image, tap Send, and a few seconds later it appears on someone else's phone. Behind that simple action, however, several things may happen that most people never notice. It Starts on Your Device The photo already exists on your phone before you send it. Depending on your device settings, it may also be part of your gallery or included in local or cloud backups. Before the Photo Is Sent Most messaging apps prepare the image before sending it. They may reduce the file size, create a preview, or optimize it so it can be delivered faster. These steps happen automatically in the background. Sending the Photo If the app supports end-to-end encryption, the photo is encrypted before it leaves your device. This helps protect the image while it is traveling across the internet. After that, the message is routed through the app's delivery infrastructure until it reaches the recipient. After It Arrives Once the recipient opens the photo, it exists on their device. Depending on the app and their settings, it may also be saved to the phone's gallery or included in future backups. At this point, the recipient can also take a screenshot or forward the image to someone else. Encryption protects the photo while it is being transmitted, but it cannot control what happens after the recipient has access to it. Final Thoughts When we send a photo, we often think only about the moment we press Send. In reality, there can be several stages between your device and the recipient, and in some cases, multiple copies of the same image may exist over time. Understanding this process is an important part of understanding digital privacy. While researching these privacy challenges, I started building VeilComm to explore how private communication could give users more control over their data—not just while it's being transmitted, but throughout its entire lifecycle.

Federal lawyers say anti-mask laws would endanger immigration agents, citing an ICE face-recognition art project that doesn’t actually work.

The new U.K. government scrapped a digital ID program that millions of British people opposed, in place of a tax cut to tackle the cost of living.

It’s a lot : According to information obtained by The Tech , MIT is spending over $3 million on more than 500 AI surveillance cameras in academic buildings, residence halls, and outdoor areas along Memorial Drive. Installation of the new cameras, along with the wiring and infrastructure that will support them, began November 2025 and will likely continue until September 2026. Technical specifications for the cameras suggest that they will be capable of collecting real-time face and object classification data, including detection of motion, loitering, crowds, face masks, and camera tampering. Individuals can also be automatically classified on the basis of clothing color, gender, and age, up to a distance of 35 feet (11 meters) from the camera. According to a statement from MIT spokesperson Kimberly Allen, any collected data is “retained up to 30 days,” unless an exception is granted...

Every time I needed to check whether my microphone actually worked before a call, or whether a key on a used keyboard was dead, I ended up on some sketchy "free online tester" that wanted an account, showed six ad banners, and — the worst part — happily streamed my webcam to a server I knew nothing about. So I built the thing I actually wanted: TestOnDevice — 118+ device tests that run 100% in the browser. No installs, no account, and nothing you record ever leaves your machine. Here's what I learned building it. The core constraint: the network is off-limits The single rule that shaped the whole project: no device data touches a server. No webcam frames, no audio buffers, no keystrokes, no sensor readings. That constraint turned out to be freeing rather than limiting, because modern browser APIs are genuinely powerful. Almost every "device test" is just a Web API plus a bit of rendering: What you're testing The API doing the work Microphone / speakers MediaDevices.getUserMedia , Web Audio ( AnalyserNode ) Webcam getUserMedia , <video> , MediaStreamTrack.getSettings() Keyboard keydown / keyup , KeyboardEvent.code Mouse / touch / stylus Pointer Events, PointerEvent.pressure Gamepads Gamepad API MIDI keyboards Web MIDI API Display ( dead pixels , refresh rate ) Fullscreen + requestAnimationFrame Motion / orientation DeviceOrientationEvent , DeviceMotionEvent A live mic meter, entirely local The microphone test is a good example of how little you need. Grab a stream, wire it into an AnalyserNode , and compute RMS on each frame for a level meter — no recording, no upload: const stream = await navigator . mediaDevices . getUserMedia ({ audio : true }); const ctx = new AudioContext (); const analyser = ctx . createAnalyser (); ctx . createMediaStreamSource ( stream ). connect ( analyser ); const data = new Uint8Array ( analyser . frequencyBinCount ); function tick () { analyser . getByteTimeDomainData ( data ); let sum = 0 ; for ( const v of data ) { const x = ( v - 128 )

A video from Gamers Nexus explains how, after connecting a new LG UltraGear monitor to a PC running Windows 11 for the first time, Windows Update is silently installing LG driver updates and the LG Monitor App Installer, without so much as a permission pop-up or notification. The app doesn't appear to include special controls […]

InfoQ has opened enrollment for three five-week online certification cohorts starting in August, each led by a senior practitioner applying QCon talk frameworks to participants' own work: architecture with Luca Mezzalira, engineering leadership with Michelle Brush, and AI security and privacy with Katharine Jarmul. By Artenisa Chatziou

A new toolkit for attorneys in Massachusetts targets the technologies police use—and conceal—to build criminal cases, from facial recognition to AI-written police reports.