标签：#privacy

VeraCrypt is easy to use badly. You can choose an unnecessarily complicated cipher cascade, forget a custom PIM, leave the only copy of a keyfile on a dying USB stick, sync a mounted container through two computers, or discover during a boot failure that your recovery media was never tested. None of those failures means the cryptography was broken. They mean the surrounding system was badly designed. This guide focuses on both sides of VeraCrypt: how to operate it and how to make defensible decisions about passwords, key derivation, filesystems, backups, system encryption, hidden volumes, SSDs, and recovery. The instructions and terminology here were checked against VeraCrypt 1.26.29 , released on June 9, 2026, and current as of September 2026. Version 1.26.29 is especially significant because it adds Argon2id for non-system volumes and fixes a plausible-deniability issue affecting some hidden volumes created by versions 1.26.6 through 1.26.28. ( veracrypt.io ) TL;DR If you want the short version: Use an encrypted file container for a manageable collection of sensitive files. Encrypt an entire USB stick or external drive when everything on it should be protected. Use VeraCrypt system encryption only on supported Windows x64 systems, and only after creating and testing recovery media. Use FileVault for a Mac startup disk and LUKS for a Linux system disk. VeraCrypt does not provide macOS or Linux system encryption. For a new non-system volume in VeraCrypt 1.26.29, use the default AES encryption algorithm and Argon2id KDF unless you need compatibility with an older VeraCrypt installation. Leave PIM at its default unless you understand the security, memory, performance, and recovery consequences. Prefer a long, unique password over unusual cipher combinations. Treat keyfiles as additional credentials that must be backed up perfectly. Never store your only backup inside the encrypted volume it is supposed to protect. Unmount a volume before unplugging its device, copying

A torrent client that works on your iPhone I wanted to download a film to my iPad on a train and watch it. That turned out to be surprisingly hard. Every torrent app worth using is desktop software. On iOS there's essentially nothing — Apple doesn't allow it, so the App Store options are either gone, crippled, or asking for a subscription to a "cloud downloader" that keeps a copy of everything you touch on somebody else's server. So I built one that just runs in a browser tab. No install, no account, no App Store. It's at wasmtorrent.pages.dev if you'd rather poke at it than read about it. What it does Open the page, paste a magnet link, and it downloads. The whole client is compiled to WebAssembly and runs inside your browser — there's no server of mine involved at any point. A few things that make it actually usable rather than a demo: Stream while it downloads. You can start watching before it finishes, and seek around — it fetches the parts it needs. Files whose codecs your browser refuses fall back to a software player. Save to your device. On iPhone and iPad that means straight into the Files app, in Downloads. Install it to your home screen. It's a progressive web app, so it gets an icon and its own window, and the interface works offline. It tells you when downloads finish , with a deliberately vague message — "one of your downloads has finished", never the name. Notifications land on lock screens where anyone can read them. The awkward part, explained honestly Here's the thing nobody tells you about torrents in a browser: a browser can only make WebRTC connections. Ordinary torrents use TCP peers. A web page physically cannot dial those — it's not a limitation of my code, it's what a browser is. So most magnet links you find will sit at 0% forever in any in-browser client, including this one. That's why they all feel broken. The fix is a small companion app called the bridge. You run it on a computer you already leave on — a Mac, a PC, a Linux box, a home s

Originally published on lockmargin.com Last weekend I asked myself an uncomfortable question: could someone post my app and a valid license key on a torrent, and anyone use it for free? The answer is yes. That question sat with me all weekend. I couldn't build anything else until I mapped it, so this is the map. Context: I'm building LockMargin, a local-first invoicing app for freelancers. $49 once. No account. No telemetry. No phone-home of any kind. The license is a signed token the app verifies locally. The threat model First, I narrowed the problem. I'm not trying to stop professional cracking crews or commercial resellers. I'm trying to survive the casual kind: a key shared in a chat, an installer plus key on a torrent, "send me your key" between friends. Then I drew a hard line. If a mechanism breaks on a new laptop, a wiped disk, a VM - it's out. If it needs a server - out. If it needs an account - out. The app has to keep working even if my company disappears. Every option on my list had to pass that test. The honest ceiling Here is the fact most DRM marketing hides: if an application can locally answer "this token is valid," then anyone holding the same token gets the same answer. Copying the authorization is always possible when verification is local. That is not an implementation flaw. It is the architecture. Two different things get conflated here. Authenticity: did I publish this binary? Code signing answers that. Authorization: does this person own a license? A signed local token answers that. Neither prevents a buyer from handing a valid token to somebody else. And two different threats. Sharing is when a buyer gives their key to another person - the contractual and social layers help with that. Cloning is when the installer and a valid key travel together. That is where the hard limit appears: if a real installer plus a real key spreads, an offline application cannot tell the new user from the owner. I say that plainly, because pretending otherwise i

Not sure it’s practical, but it’s certainly striking .

## Why I built this Checking URLs one at a time during a site migration or relaunch is tedious, and the tools that do it in bulk for free — Ahrefs, SEMrush, Screaming Frog — gate that behind a paid plan. So I built Bulk URL Checker for ForgePlug : a free batch URL checker that handles up to 100 URLs per run, no account required. What it does Check status codes, full redirect chains, and response latency for up to 100 URLs at once Three ways to feed it URLs: paste directly, upload a CSV (auto-detects the URL column), or parse a sitemap Follows up to 20 redirect hops, recording the status code and Location header at each step Streams results in real time as each URL finishes, instead of making you wait for the whole batch Export as a formatted text report or properly-escaped CSV Built with SSRF protection from the ground up Since it fetches arbitrary URLs server-side, every redirect destination is validated against private IP ranges (10.x.x.x, 192.168.x.x, 169.254.169.254) before it's followed — so it can't be tricked into hitting internal infrastructure. No URLs are stored; everything lives only for the active session. Details Runs server-side (Node.js) with a concurrency pool of 10 simultaneous requests. Free tier caps at 100 URLs per run — a commercial plan is planned for unlimited batches, scheduled re-checks, and branded reporting. Try it: https://www.forgeplug.com/tools/bulk-url-checker Would love feedback, especially from anyone running site migrations or link audits.

I have no idea what I'm f*cking doing. Something I figured out today: I do not start with the dark version of an idea. I start with a random curiosity, chase it because it is interesting, and then somewhere in the middle I look up and go: oh. This could turn bad. And it is probably already turning bad somewhere, run by someone who never bothered to look up. That happened again this week, while I was thinking about what I want my memory system to do next. So let me walk through the curiosity, and then the exact moment it flipped. AI memory is mostly boring Useful. But boring. Most memory systems store things like: what projects you are working on what tools you use what your preferences are what decisions you already made what facts should survive between sessions I built one of these. It is called mycelium. Connections between memories get stronger when I use them and fade when I do not, so it is a little more alive than a notes file. But at the end of the day it stores what I know. So an AI plugged into it eventually learns: I use Proxmox. I prefer LXC for a lot of workloads. I am building an operating system. I like local-first systems. I am suspicious of unnecessary dependencies. Cool. Accurate. Still not the thing I actually care about. It captures what I know. It does not capture how I think. And more specifically, it does not capture how I become curious. Humans randomly wonder about shit At least I do. I will be working on something unrelated and suddenly think: Wait, why does this work like that? Then: Has anyone tried it differently? Then: Is this whole abstraction actually necessary? And three hours later there is a new project directory on my machine and I am questioning all of my life choices. An LLM can generate questions if I ask it to. That is not the same thing. What it does not have is the persistent causal chain that led me, specifically, to ask certain kinds of questions over and over. A human brain does something like: event ↓ this feels weird ↓

Hi DEV! I was fed up picking up my phone to type a six digit code into the machine I was already sitting at. The desktop authenticators I tried either wanted an account, synced my secrets to their cloud, or both, which rather defeats the point of the thing being under my control. AuthGeek is a TOTP and HOTP authenticator that keeps everything local: Secrets in a local vault, encrypted with Argon2id Add accounts by scanning a QR code off the screen, or paste the secret Encrypted backup and restore, so you are not locked into one machine No account, no sync, no telemetry Why I built it The design brief was one sentence: nothing about my second factor should require somebody else's server. I want to be straight about the trade though. Keeping codes on the same machine you log in from is weaker than a separate phone. If your PC is compromised, both factors are on it. For a lot of threat models that is fine, for some it is not. If it is not, keep using your phone, and I would rather say that than pretend otherwise. Tech stack .NET 8, net8.0 Avalonia for the UI Konscious.Security.Cryptography.Argon2 for the vault key derivation ZXing.Net for QR decoding Argon2id over PBKDF2 because the whole value proposition here is the vault, and memory hard is the right default in 2026. Honest caveat The installer is not code signed yet, so SmartScreen may warn on first run. For a security tool I appreciate that is a worse look than usual. It is on the list. Links Site: https://techygeekshome.info/authgeek/ Source: https://github.com/techygeekshome/AuthGeek Video: https://youtu.be/HtrjpdrUe-g If you spot something wrong in the crypto, please open an issue rather than being polite about it.

A simple browser-local PNG-to-PDF workflow For this kind of job, the useful workflow is straightforward: Select the PNG, JPG, or JPEG files. Put the pages in the order they should appear. Choose a page size and margins if the document needs them. Export one PDF. The important detail is where the conversion happens. A browser-local PNG-to-PDF tool processes the images in the browser instead of uploading them to a conversion server. That makes it easier to keep control of source files while still producing one shareable PDF. When this is useful This workflow is handy for: combining screenshots into a bug report or handoff document; turning scanned pages into one file for email or printing; arranging portfolio images or design exports in a deliberate order; and collecting receipts or reference images without making a separate document first. Before exporting, check the page order and decide whether each page should match the image, A4, or US Letter. A preview is useful here: it catches a stray portrait page, an oversized margin, or a screenshot in the wrong position before the PDF is created. The tool I use for this I maintain PNG Binder , a free PNG-to-PDF converter for this specific workflow. It accepts up to 50 PNG, JPG, or JPEG images, lets you arrange them, and creates one PDF locally in the browser. It does not require an account, and the images are not sent to a conversion server. It creates an image-based PDF, so it does not perform OCR or rebuild text and tables. If that is the kind of result you need, try it and let me know whether page ordering, page settings, or browser compatibility could be improved. Disclosure: I am the maker and operator of PNG Binder.

Right now the developer community seems fascinated (if not outright obsessed) with agentic coding. That wave is real, and it will heavily impact how we build software. But let's not forget there are other topics worth attention. Here, the focus is something less fashionable: sensitive permissions on Android. After shipping TKWeek updates outside Google Play and answering the inevitable Why isn't this on the Play Store? with a blunt Sensitive permissions , it is fair to ask whether that topic still matters in 2026. I can answer that from shipping one app for a long time. I started working on TKWeek back in 2010. Some time later I added a module called My day that shows important information for a particular day, including missed phone calls. READ_CALL_LOG is a dangerous permission since API level 23, so users who do not want to allow the app to read those details have a secure, reliable safety hatch. Still, after a late-2018 announcement, by 2019 Google Play was enforcing READ_CALL_LOG under its high-risk / sensitive rules. Now, what does that store layer mean anyway? Dangerous on the device, sensitive in the store On the platform side, Android already classifies quite a few permissions as dangerous : they guard private user data, and starting with API 23 the user must grant them at runtime. READ_CALL_LOG is in that bucket ( Manifest.permission.READ_CALL_LOG ). Google Play's extra layer sits on top of that. In Play docs the umbrella is high-risk or sensitive permissions; Call Log and SMS are restricted permission groups. Either way, it is store policy, not just OS protection. For Call Log and SMS, only narrow use cases are allowed (typically default Phone, SMS, or Assistant handlers, plus a short list of exceptions), and you must declare them in Play Console or remove them from the manifest. See Google's Permissions and APIs that Access Sensitive Information and Use of SMS or Call Log permission groups . Back in 2021 that policy stopped being theoretical. Showing mis

Homeland Security Investigations agents hit the outdoor retailer with a controversial subpoena as part of a dragnet search for the identities of protesters who entered a Minnesota church in March.

Most free online PDF tools work by uploading your document to a server, processing it there, and sending it back. For a lot of files that's fine. For a signed contract, a payslip, a medical form, or a scanned ID, it's the entire privacy problem: your document now lives on someone else's machine, subject to their logging, retention, and breach exposure. It doesn't have to work that way. A modern browser can split, merge, compress, sign, and even OCR a PDF without the file ever leaving your device — using libraries like pdf-lib , pdf.js , jsPDF and SheetJS that run entirely in JavaScript. How to tell an uploader from a client-side tool You don't have to trust a marketing claim. Two checks settle it: Watch the network. Open your browser's DevTools → Network tab, then run the tool on a file. If you see your file leave in a POST/PUT request, it uploaded. A client-side tool shows no upload of the document itself. Pull the plug. Load the page, then turn off Wi-Fi and try the tool again. A client-side tool keeps working offline. An uploader breaks the moment the network is gone. The honest tools pass both tests. If a site can't work offline, your file is going somewhere. The trade-offs, stated honestly Client-side processing isn't a free lunch, and any tool that pretends it is should make you suspicious: Memory. Very large PDFs are held in browser memory, so there's a ceiling a server wouldn't have. Speed. OCR in WebAssembly is slower than a server GPU. It's private, not fast. Fidelity. Converting PDF → Word transfers the text , not the layout — the same is true of every converter, but a client-side one can't hide it behind a server. Compression limits. A PDF shrinks by downsampling embedded images or rasterizing pages; a small or text-only PDF may not shrink at all, and rasterizing removes selectable text. We built 24 client-side PDF tools on exactly this principle and wrote down where each limit is, rather than papering over them. If you're evaluating any online PDF tool

An email file is not just text plus a few attachments. It can contain HTML, nested MIME parts, misleading filenames, inline resources, remote tracking pixels, malformed encodings, and enough data to exhaust a browser tab. Moving parsing into the browser removes an upload from the architecture, but it does not automatically make the viewer safe. It changes the security job: untrusted content is now being interpreted next to the user’s active web session. This is the checklist I use for a local EML and winmail.dat/TNEF reader. Treat every parsed field as untrusted The sender, subject, recipient, filename, MIME type, and message body all came from a file. Render headers and filenames as text, never by concatenating HTML. The same applies to errors. A parser exception can include a filename or fragment of malformed input. Showing that message verbatim may leak data into logs or turn it into markup. Map parser failures to stable error categories, then display a controlled explanation. Normalize into one internal model EML and TNEF have different container structures, but the UI should not contain two independent security implementations. Both parsers can produce a common message model: subject, sender, to, cc, date, plain body, sanitized HTML candidate, attachments[] { safe filename, MIME type, bytes, inline flag, content ID, content location } The normalization layer is the right place to enforce per-source limits and reject unsupported structures. The viewer and download code then work against the same constrained data regardless of input format. Sanitize HTML as hostile input Email HTML was designed for mail clients, not for direct insertion into an application DOM. A conservative policy removes: scripts and event handlers; forms and interactive controls; iframe , object , and embed elements; styles and CSS URLs; unsafe protocols; executable or unexpected embedded content. Use a maintained sanitizer with a pinned version, but do not stop at its default configuration.

This week on Uncanny Valley, we dig into the latest prediction market buzz, Flock’s AI-powered police search tool, and how tech bros don’t know how to talk about “rouge” AI agents

DJI has announced a second generation of its Romo robovac. The Romo 2 series is quieter, more powerful, and better at climbing over small steps and other obstacles. But more importantly for DJI, a new local-only data mode should go some way to reassuring anyone concerned by the first Romo's serious security flaws. There are […]

WIRED rebuilt Flock’s latest search tool from code the company sends to a police officer’s browser. Its AI can keep watch across multiple cameras for anyone fitting a written description.

Originally published on indiecore.net . I deployed, opened the console on the live site out of habit, and found this: Loading the script 'https://static.cloudflareinsights.com/beacon.min.js/v3d52…' violates the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' 'inline-speculation-rules'". The action has been blocked. I had not added that script. It is in no template, no build output, and no dependency. grep -c cloudflareinsights dist/index.html returns 0. It is not in the page you build Cloudflare Web Analytics has an automatic mode, on by default when a site is added, that injects beacon.min.js into HTML responses at the edge. Your origin never sees it. Your repository never contains it. It also does not inject for everything. I fetched the same URL with curl, then again with a full desktop browser User-Agent, and neither response carried the script. Only a real browser navigation gets it, which is why Lighthouse saw it and my terminal did not. That combination is worth sitting with for a second. The artefact exists in production, is absent from your source, and cannot be reproduced with the tool most of us reach for first when we want to see what a server actually returned. Nothing was tracked The CSP did its job. From the Lighthouse network trace: url : https://static.cloudflareinsights.com/beacon.min.js/v3d52… resourceType : Script statusCode : -1 transferSize : 0 Status −1 with zero bytes transferred means the request never started. The browser matched the URL against script-src , found no permitted source, and refused before opening a connection. No data left anyone's browser. So the console error is the sound of a guard working. It still costs something: a logged error drops the Best Practices category from 100 to 92, and a red line in the console trains you to ignore red lines in the console. The fix everyone reaches for is the wrong one here Search the error and the common answer is to add https://static.cloudflareinsights.com

The Nordic country says wearable camera headsets need to be regulated given their privacy risks.

Comcast has added motion detection as a feature to its wireless routers: The feature sends push notifications to users when motion is detected near a connected device, such as a TV or printer. It has different settings for when people are home, asleep, or away. The Xfinity app also lets users see live motion activity and a feed of recent activity. Comcast acknowledges that the system has some limitations. Home size, layout, building materials, and the placement of the router and connected devices can all affect its ability to detect motion. Comcast says it does not guarantee its performance...

Voice dictation is one of those tools that can quietly improve an entire day. OpenWhispr/openwhispr is gaining attention on GitHub, with 43 stars added today, because it treats dictation as a local-first productivity utility rather than just another cloud transcription feature. The project supports local speech-to-text models, including Nvidia Parakeet and Whisper, while also allowing cloud models through a bring-your-own-key workflow. That gives developers an important choice: keep audio on the device for privacy, or trade some privacy for potentially faster or more capable hosted inference. A practical way to start exploring the source is: git clone https://github.com/OpenWhispr/openwhispr.git cd openwhispr git log -5 --oneline For everyday use, the fastest path will usually be the project’s cross-platform release package. After installation, configure a local model if your machine has suitable hardware, or add your own provider credentials through the application settings. Keeping credentials in the app’s secure configuration storage is preferable to committing them to shell history or dotfiles. The architecture choice is especially interesting for independent developers. Local inference can reduce recurring API costs and keeps sensitive conversations away from third-party servers. The trade-off is hardware dependency: CPU-only transcription may introduce noticeable latency, while GPU acceleration can require additional drivers, memory, and model downloads. Before deploying this into a team workflow, I would watch for: Model consistency: Different Whisper or Parakeet variants can produce noticeably different punctuation, latency, and accuracy. Operational boundaries: Local processing improves privacy, but model files, logs, clipboard integration, and temporary audio buffers still need review. The strongest value proposition is not merely “speech recognition.” It is giving users control over where transcription happens. For developers who dictate code, documentati

Open a page and it can start guessing which browser extensions you run before you click a thing. Not "extensions in general" - which ones . Your password manager, your ad blocker, the wallet, the internal tool your employer ships, the accessibility extension you depend on. The page never asks and you never see it happen. This is not a bug in Chrome. It is the sum of a few features working exactly as designed, and the people best placed to close it are extension authors who mostly do not know they left it open. I maintain an extension and a library that talks to it, so I have spent real time on the detectable side of this. Here is how a page does it, what the answer is worth to whoever is asking, and what actually stops it. Technique one: ask the extension directly Some extensions accept messages from web pages on purpose - our own does, so a customer's "report a bug" button can tell whether the extension is there. The API is chrome.runtime.sendMessage : chrome . runtime . sendMessage ( EXTENSION_ID , { type : ' ping ' }, ( reply ) => { if ( reply ) { // it is installed, and it answered } }); For a page to be allowed to send that message, the extension has to list the page's origin in its manifest, under externally_connectable . Authors who want their extension to work with any site reach for the wildcard: "externally_connectable" : { "matches" : [ "<all_urls>" ] } And that one line is the door. <all_urls> does not mean "my customers' sites". It means every site on the internet may now open a channel to this extension - which means every site may ping it and learn whether you have it. The convenience the author wanted for their own pages, they handed to everybody's. This technique is narrow, because it only finds extensions that chose to talk to pages. The next one is not narrow. Technique two: knock on the extension's own files Extensions ship assets - icons, injected stylesheets, images. Any asset marked web-accessible is reachable at a fixed URL built from the ext