Work sent me mandatory privacy training. The screenshot tracker confirmed I watched it. #privacy #surveillance

Did you know? You can make encrypted data unreadable without overwriting the data itself. Cryptographic erasure destroys the keys needed to decrypt it, leaving ciphertext behind. That only works with sound encryption and no surviving usable key copies; it does nothing for old plaintext remnants. A recovery key you forgot about can also be a recovery key for someone else. #privacy #cypherpunk

My bank prints “official” on the envelope. My Bitcoin node has no setting for impressed. #bitcoin #cypherpunk

Did you know? The wearable you already bought may not need its original app to stay useful. Open-source Gadgetbridge replaces vendor apps for supported watches and bands; NOOP reads WHOOP 4.0/5.0 straps over Bluetooth without a WHOOP account or cloud. One important distinction: NOOP is source-available under a noncommercial license, not open source. Compatibility varies, features can be missing, and a replacement app cannot wish away hardware limits or cloud-only services. #cypherpunk #RightToRepair

The club asked if I was over 21. The ID scanner took my life story as supporting evidence. #privacy

Did you know? Secure voice traffic can reject replayed packets without demanding that every packet arrive in order. SRTP can keep a sliding window of packet numbers: an unseen packet inside the window can still pass, while a duplicate is rejected. The receiver updates that record only after authenticating the packet, so a forged packet cannot claim a place in the history. Security needs a memory of what arrived, not an assumption that the network delivers neatly. #cryptography #cypherpunk

My smart scale needs an account. Gravity was happy to work offline. #privacy #IoT

Did you know? Checking whether a website certificate was revoked can tell its issuer which site you are visiting. With direct OCSP checks, the certificate authority sees the certificate being checked and your IP address. OCSP stapling lets the website send a signed status response during the TLS handshake instead, so your browser need not make that revealing request. A security check should not double as a browsing report. #privacy #cypherpunk

Paid for the fridge. Still getting ads. Apparently I'm the recurring revenue. #privacy #IoT

Did you know? Stealing an access token does not have to be enough to use it. OAuth DPoP binds the token to a public key and requires a signed proof with each protected request, so a copied token alone is useless. The catch: malicious code running inside the legitimate app may still be able to use its signing key. Protecting a key from export is not the same as protecting it from misuse. #cypherpunk #security

I paid a DNA company to find my relatives. Bankruptcy found my data a new owner. #privacy

Did you know? Proving that a DNS name does not exist can expose names that do. DNSSEC's NSEC records name the neighbours around a gap, letting someone walk through a zone's names. NSEC3 replaces those names with hashes, but an observer can still hash likely names offline and compare. Hashing a directory is not the same as keeping it secret. #privacy #cypherpunk

The encrypted message I received survived the hackers. My lock screen preview didn't. #privacy

Did you know? Your device can rotate its IPv6 address while still advertising which network it belongs to. IPv6 temporary addresses (RFC 8981) change the interface identifier over time to limit address-based tracking, but leave the network prefix visible. A stable home prefix can still group the household’s traffic, and your router can still track the device’s addresses. Rotating an identifier is not the same as hiding your network. #privacy #cypherpunk

My gift card charges rent for sitting in a drawer. Cash has been squatting there for years. #cash

Did you know? A log can reveal that a message is missing, not just that one was edited. Signed syslog (RFC 5848) sends signed blocks of message hashes and sequence information, letting a collector detect gaps and reconstruct the original order when those blocks arrive. It cannot recover a missing message, and signing alone leaves the logs readable on the wire. Evidence of tampering and confidentiality are different jobs. #security #cypherpunk

The tax office got my income forms before I did. Now we're playing 'guess what I know.' #bureaucracy #cypherpunk

Did you know? A server can help evaluate a secret-keyed function without learning the input it is evaluating. An OPRF lets the client learn the output while the server learns neither the input nor the output; a VOPRF also lets the client verify which server key was used. That makes privacy-preserving password systems possible without handing the server every value in the clear. #privacy #cryptography #cypherpunk

I own the tractor. The dealer owns the 'OK' button. #RightToRepair

Did you know? Ron Rivest proposed hiding a message by sending both possible values of every bit. In his 1998 "chaffing and winnowing" scheme, the real bit carries a valid authentication tag and its decoy a bogus one; the shared secret key tells the receiver which to keep. The bits themselves travel in the clear. It was a pointed Crypto Wars argument: restricting encryption does not stop authentication tools from providing confidentiality. #cypherpunk #cryptography