标签：#privacy

Plus: AI bug hunting fuels Microsoft’s biggest-ever Patch Tuesday, ShinyHunters ransomware gang exploits an Oracle zero-day, and more.

A WIRED investigation found dozens of “nudified” deepfake images and videos on Grok's website, including nonconsensual depictions of celebrities and at least one prominent US politician.

Congress has failed to pass a three-week extension of Section 702 of the Foreign Intelligence Surveillance Act (FISA), with the House voting 218-198 against reauthorizing the controversial warrantless wiretapping authority through July 2nd. After a short-term extension earlier this year, the spying program now appears set to lapse for at least a week. This is […]

The new open-source project could serve as the basis for a future of apps with features as complex as Slack, Discord, or Google Docs—but with added protection against surveillance.

For years, whenever I needed to merge two PDFs or compress a file to upload to a government portal, I would Google "compress PDF", click the first result, and inevitably hit a paywall. "You have reached your 2 free files per day limit." Worse, I was uploading sensitive documents—tax returns, medical records, and NDAs—to random servers in God-knows-where just to strip out some heavy images. I decided to build an alternative. I wanted it to be 100% free, have absolutely no daily limits, and most importantly: zero server uploads . Here is how we built PDF Pro using Next.js and WebAssembly to process PDFs entirely natively inside the user's browser. The Architecture: Why WebAssembly? Traditional PDF tools (like Smallpdf or iLovePDF) use a monolithic server architecture. You upload your file to their AWS bucket, their backend runs a Python or C++ script (usually using Ghostscript or a proprietary library) to manipulate the PDF, and then you download the processed file. This architecture is expensive (high bandwidth and compute costs) and creates a massive privacy liability. By compiling a C++ PDF manipulation library down to WebAssembly (WASM) , we inverted the architecture. 1. The Build Process We took pdf-lib and custom C++ compression algorithms and compiled them to a lightweight .wasm binary. When a user visits PDF Pro Compress , their browser downloads the ~2MB WASM file once and caches it. 2. Client-Side Processing When you drag and drop a 50MB PDF into the UI, it never hits our server. Instead, the browser's JavaScript engine passes a Pointer to the file data directly into the WebAssembly memory buffer. The WASM module executes native C++ speeds directly on your local CPU to compress or merge the document. Performance Benchmarks Because there is zero upload and zero download time, the performance metrics are staggering: 10MB PDF Compression (Cloud): ~15 seconds (Upload) + 4 seconds (Process) + 5 seconds (Download) = 24 seconds . 10MB PDF Compression (PDF Pro WASM)

The Problem with Most Online Formatters You know the drill. You paste some JSON into a random online formatter, or convert a CSV to Markdown, or format a WeChat article. The tool works fine, but have you ever stopped to think about what happens to your data? Most "free" online tools send your content to their servers. Some store it. Some log it. Some sell aggregated data. You have no idea where your sensitive JSON payload, proprietary CSV data, or internal documentation ends up. The Client-Side Alternative I built tools.pixiaoli.cn — a collection of 33+ developer utilities that run entirely in your browser . No server uploads. No data collection. Your content never leaves your machine. What's Inside Here's a taste of what's available: JSON Formatter & Validator — Format, minify, validate, and tree-view JSON instantly CSV Converter — Convert between CSV, JSON, and Markdown tables WeChat Markdown Editor — Write Markdown and preview it exactly as it appears in WeChat articles Base64 Encoder/Decoder — With file upload support URL Encoder/Decoder — For query parameters and path segments Hash Generator — MD5, SHA-1, SHA-256, SHA-512 Color Converter — Between HEX, RGB, HSL, and named colors Regex Tester — Live pattern matching with highlighted results Diff Viewer — Side-by-side text comparison Code Formatter — JavaScript, CSS, HTML, SQL, and more UUID Generator — v4 UUIDs for APIs and databases QR Code Generator — Customizable with logo support Markdown Preview — Live split-pane editor Image Format Converter — PNG, WebP, JPEG, GIF, BMP, AVIF Text Case Converter — camelCase, snake_case, kebab-case, and more Lorem Ipsum Generator — Customizable paragraph count and word limits HTML Minifier — Remove whitespace and comments CSS Minifier — Compress stylesheets JavaScript Minifier — Obfuscate and compress JS XML Formatter — Pretty-print XML documents YAML Formatter — Validate and format YAML HTML to Markdown — Convert rich HTML to clean Markdown Markdown to HTML — Render Markdow

Audit thousands of passwords against data breaches — completely in your browser with zero-knowledge privacy. Published: June 9, 2026 TL;DR Most bulk password checkers require you to upload your entire vault. Utilora’s Bulk Password Breach Checker uses HIBP’s k-anonymity + local hashing so your passwords never leave your device . The Hidden Risk Most People Ignore Using a password manager is excellent, but it’s not enough. Many users unknowingly reuse or slightly modify passwords that have already been leaked in massive breaches (LinkedIn, Adobe, Yahoo, etc.). Manually checking hundreds or thousands of passwords is impractical — which is why people turn to bulk checkers. The problem? Most bulk checkers ask you to upload your password list . That creates a massive new privacy risk. How Utilora’s Zero-Knowledge Breach Checker Works We built this tool using a privacy-preserving technique called k-anonymity (popularized by Troy Hunt of Have I Been Pwned). Step-by-Step Technical Process: Local Hashing — Your browser uses the WebCrypto API to create a SHA-1 hash of each password locally. Prefix Only — Only the first 5 characters of the hash are sent to HIBP’s Range API. Server Response — HIBP returns hundreds of matching hashes that start with the same prefix. Local Comparison — Your browser checks if your full hash exists in the returned list. Result: HIBP knows someone checked a password starting with ABC12 , but has no idea which specific password it was. Why You Should Audit Your Entire Vault Regularly Discover weak or compromised passwords you forgot about Clean up old reused passwords Respond quickly after major breaches Maintain good password hygiene across all accounts Real-World Scenarios You exported your Bitwarden / 1Password / KeePass vault You want to check 500+ passwords before a security audit You just heard about a new major breach and want to verify impact You’re helping a family member or client secure their accounts How to Use the Tool Go to the Bulk Pas

US lawmakers are alarmed that Bill Pulte, a housing official with no intelligence experience, is poised to take charge of one of the government's most powerful surveillance tools.

Google is making some changes to how it saves your interactions with Search. In an email sent to users, Google says it will save the images, files, audio, and video you use to search under a new "Search Services History" setting. That includes the images you search for with Google Lens, recordings from its real-time […]

The ACLU is suing two Florida police departments over the arrest of a Fort Myers man in a child-abduction case, saying officers treated a flawed face-recognition match as a near-certain ID.

When I built whatsmy.fyi , I assumed I'd need a geolocation provider: MaxMind, ipinfo, ip-api, pick your poison. They all mean the same thing: an external dependency, an API key, a quota, added latency, and someone else's server seeing your users' IPs. Then I found out Cloudflare Workers makes the whole category unnecessary. The cf object Every request that hits a Cloudflare Worker carries a request.cf object, populated at the edge before your code even runs. No lookup, no latency, no key. Here's what's inside: { asn : 34984 , // ISP's autonomous system number asOrganization : " Superonline " , // ISP name city : " Istanbul " , region : " Istanbul " , country : " TR " , continent : " AS " , isEUCountry : undefined , // "1" if EU, undefined otherwise latitude : " 41.01380 " , // string, not number! longitude : " 28.94970 " , postalCode : " 34000 " , timezone : " Europe/Istanbul " , colo : " IST " , // which CF datacenter handled this clientTcpRtt : 12 , // user's RTT to the edge, in ms httpProtocol : " HTTP/3 " , tlsVersion : " TLSv1.3 " , tlsCipher : " AEAD-AES128-GCM-SHA256 " } That last group surprised me most: you get the user's HTTP protocol, TLS version, and actual TCP round-trip time for free. Try getting that from a geo API. A complete IP endpoint in ~30 lines export default { async fetch ( request ) { const cf = request . cf ?? {}; const ip = request . headers . get ( " CF-Connecting-IP " ); return Response . json ({ ip , city : cf . city ?? null , country : cf . country ?? null , isp : cf . asOrganization ?? null , asn : cf . asn ?? null , timezone : cf . timezone ?? null , lat : cf . latitude ? parseFloat ( cf . latitude ) : null , lng : cf . longitude ? parseFloat ( cf . longitude ) : null , protocol : cf . httpProtocol ?? null , tls : cf . tlsVersion ?? null , rttMs : cf . clientTcpRtt ?? null , }); }, }; That's the entire backend. No database, no GeoIP file to update monthly, no vendor. The gotchas (learned the hard way) 1. Coordinates are strings. lati

The organization claims that the FIFA tournament could have impacts on the rights of local people and visiting soccer fans in all three host countries.

Most US World Cup stadiums are surrounded by surveillance cameras. Want to know if you’re being watched on your way to a match? These maps will help you.

From anti-drone tech to face recognition, 2026 World Cup stadiums in the US, Canada, and Mexico are subjecting fans to an array of surveillance tech. Here’s what you need to know.

Every week I open a new browser tab and search for something like "json formatter online" or "jwt decoder" or "regex tester". And every week I land on a site that: Shows me three ad banners before I can see the tool Requires me to create an account to "save" my work Is quietly uploading my payload to their server That last one bothers me most. Developers paste real things into these tools — JWT tokens with live user data, passwords they're about to deploy, private keys, internal API responses. Most people assume these tools are "just a webpage" and nothing is being sent anywhere. Often that's not true. So I built SnapTxt — a collection of 50+ developer utilities that run 100% client-side. No backend. No account. No tracking. Your data never leaves your browser. What's in it The toolkit covers the things I reach for most often: Data & text JSON formatter, validator, minifier, diff, tree explorer SQL formatter XML formatter YAML → JSON, CSV → JSON converters Base64 encode/decode, URL encoder, hash generator Auth & security JWT decoder & generator RSA key generator bcrypt generator x.509 certificate decoder Password generator Images Image compressor Image format converter Image to text (OCR via Tesseract.js) SVG to PNG, favicon generator, code-to-image Frontend / CSS Regex tester CSS gradient generator, box shadow generator Color converter Mermaid live editor HTML live editor, HTML to Markdown, HTML to JSX Cron expression builder And more — word counter, text diff, unix timestamp, lorem ipsum, QR code generator, markdown to PDF, and a collection of Australian and NZ business number validators. How it's built It's a Next.js app deployed as a fully static export to Firebase Hosting. There is no server. Every tool runs in the browser using: CodeMirror 6 for editor-style inputs Tesseract.js for OCR (runs a WASM binary in a web worker) Chrome's built-in Prompt API (Gemini Nano) for the AI explain features in JSON, SQL, and JWT tools — meaning even the AI inference is on-dev

Meta is planning to use the data shared by other businesses to personalize your feed and its AI responses. In a blog post on Tuesday, Meta explains that it already uses your off-platform activity, like the games you play or your purchases on other websites, to serve you ads. But now it's expanding the scope […]

When developers think about privacy, they often think about legal compliance, consent banners, or policy pages. But privacy starts much earlier than that, at the API layer. Every time your backend asks for a phone number, date of birth, location, or optional profile field, you are making a design decision. If you collect too much data by default, you increase risk, reduce trust, and make your system harder to maintain. The good news is that privacy by design does not have to make your product worse. In many cases, it makes your API cleaner, safer, and easier to reason about. Why collecting less data matters The more data you collect, the more you have to protect. That means more storage, more access control, more breach risk, more compliance burden, and more user distrust if something goes wrong. A developer friendly privacy approach is simple: Only collect what you need to deliver value. Bad pattern: collecting everything up front user_profile = { " name " : " Amina " , " email " : " amina@example.com " , " phone " : " 07000000000 " , " dob " : " 1995-01-01 " , " address " : " 123 Main Street " , " location " : " Lagos " , " gender " : " female " } This kind of structure is common in early stage products. The thinking is usually: let us ask for everything now, just in case we need it later. But just in case is not a good privacy strategy. Better pattern: collect only what is required def build_profile ( name , email , phone = None ): profile = { " name " : name , " email " : email } if phone is not None : profile [ " phone " ] = phone return profile user_profile = build_profile ( " Amina " , " amina@example.com " ) print ( user_profile ) This is small, but the principle matters. Optional data should stay optional unless it is truly needed. Use explicit field validation Instead of accepting a giant payload and filtering it later, validate the exact fields you expect. ALLOWED_FIELDS = { " name " , " email " , " phone " } def sanitize_payload ( payload ): return { k :

The code WIRED identified is gone from the latest version of Meta AI, the companion app for the company’s smart glasses. Meta won’t say why or whether it’s coming back.

The bill is expected to blanket-ban companies and startups from selling people's precise location data across the state.

Hey DEV community! 👋 I just completely rebuilt and launched Mailfo v2.0 , an privacy-focused temporary disposable email app for Android[cite: 1, 2]. The first version got the job done, but it lacked the fluid user experience, offline reliability, and sleek UI that modern mobile apps need. I decided to tear it down and rewrite it from scratch using Jetpack Compose , Room DB , and modern Android architecture[cite: 1]. Here is a breakdown of what went into the rebuild, why privacy tools like this are essential, and what's new[cite: 1]. 🛡️ Why Use a Temporary Disposable Email? We’ve all been there: you want to download a single source-code snippet, test a new app, or sign up for a one-time service, but you don't want your primary inbox flooded with endless marketing spam[cite: 1]. A disposable email address acts as your personal buffer[cite: 1]. It protects your personal data, prevents tracker exposure, and keeps your real inbox clean[cite: 1]. ⚠️ Pro-tip: Mailfo is designed strictly for low-risk temporary email needs[cite: 1]. Do not use disposable email addresses for banking, legal accounts, or primary account recoveries[cite: 1]! 🛠️ The Tech Stack & Architecture Upgrades Moving from version 1.0 to 2.0 meant migrating away from legacy views to a fully declarative UI workflow[cite: 1, 2]. UI/UX Architecture: Built entirely with Jetpack Compose for smooth performance, a modern look, and native Light, Dark, and System theme switching[cite: 1]. Navigation: Implemented an intuitive bottom navigation system dividing the app into distinct Home, Inbox, and Profile tabs[cite: 1]. Caching & Offline Stability: Integrated a local Room SQLite database to cache inbox summaries and message data[cite: 1]. This guarantees instantaneous screen transitions without annoying network loading spinners[cite: 1]. ✨ Key Features in Mailfo v2.0 Custom & Random Email Generator: Instantly spin up a completely randomized address or build a custom email username using multiple searchable domains[ci