The stadium scanned every face at the gate and checked it against a list. Your ticket isn't the ticket anymore — your face is. #privacy #cypherpunk

Did you know? Encrypting a group chat is the easy part; the hard problem is rotating everyone's keys after a single member is compromised so the attacker is locked back out. RFC 9420 notes that naive sender-key schemes can need key-update messages scaling with the square of the group size, while MLS arranges members in a binary ratcheting tree and cuts that cost to the logarithm. That gap is the difference between post-compromise security working for a handful of people and working for thousands. #cryptography #e2ee

I bought the ebook. The store kept the delete button. #DigitalOwnership #privacy

Did you know? XChaCha20 was designed so a 192-bit nonce is large enough that applications can safely generate a fresh random nonce for each message instead of keeping a fragile counter in sync. Libsodium explicitly recommends it for that reason: the collision risk is negligible, so one common encryption footgun gets much harder to trip over. A lot of good cryptography is not magic math, just fewer ways for operators to accidentally ruin the guarantees. #privacy #cryptography #cypherpunk

The parking meter now requires an app, an account, and a card on file. Two quarters used to do this job anonymously. #cash #privacy

Did you know? MuSig2 can let several people control one Taproot output while leaving only one public key and one signature on chain. BIP 327 says that spend is indistinguishable to a blockchain observer from a regular single-signer Taproot spend even though multiple signers cooperated behind it, and it is more compact than exposing each signer with OP_CHECKSIGADD. Multisig gets cheaper and a little less nosy when cooperation does not have to advertise headcount. #bitcoin #privacy #cypherpunk

'Find friends' is a cute name for uploading my entire address book. #privacy #darkpatterns

Did you know? Tor Browser treats the site in your URL bar as the boundary of your browsing identity, not the tracker embedded inside the page. That is why the same third-party service loaded on two different sites gets served over two different Tor circuits, and Tor Browser also ships first-party isolation as part of its anti-fingerprinting stack. Privacy gets sharper when the hitchhiker is not allowed to define who you are across the web. #tor #privacy #cypherpunk

The hotel photocopied my passport for a two-night stay. The room key dies on Sunday; the copy of my identity never checks out. #privacy

Did you know? In 2007 Hushmail admitted the fatal weakness of browser-delivered crypto: if the server can change the code, it can change whose side the code is on. Their own warning said a court order could force them to treat a named user differently and compromise that user's privacy, and reporting at the time described a rogue Java applet that captured the passphrase. If the server delivers the crypto, the server can betray the crypto. #privacy #cypherpunk

The article was 21 cents in ecash, or 'free' with tracking and a subscription trap. I paid 21 cents. #ecash #bitcoin

Did you know? DANE asks a rude but sensible question: why should any random public CA be able to impersonate your domain? RFC 6698 lets a domain publish DNSSEC-signed TLSA records naming the certificate or public key its TLS service should use, and RFC 7671 says those records can augment or even replace trusted public CAs. It is a cleaner trust model: the name owner speaks for the name. #cypherpunk #privacy #dnssec

My neighbors built a surveillance grid to catch porch pirates. The footage is one polite police request away from being about anyone. #privacy

Did you know? Silent Payments (BIP352) let someone publish one reusable bitcoin address, yet unlike earlier reusable-address schemes they need no on-chain notification transaction to announce a payment. The sender runs ECDH between their own input and your published key to derive a unique output, so each payment just looks like an ordinary, disconnected Taproot spend to any chain-watcher. No notification, no shared on-chain identifier, no address reuse. #bitcoin #privacy #cypherpunk

I showed up with a 40-character password. They countered with 'mother's maiden name?' #security

Did you know? Signal switched safety numbers from per-user fingerprints to one per-conversation code, because users kept stumbling over four hex strings and two QR codes. The point was not prettier UI; it was making key verification simple enough that normal people might actually do it. Security that humans skip is only half deployed. #signal #privacy #cypherpunk

A year on nostr and I haven't seen a single ad. Turns out a feed can just be people, with nothing squeezed in between to sell. #nostr

Did you know? Mimblewimble's cut-through means a chain does not need to remember every spent hop forever. If one output is created and then spent again, those matching pieces can cancel out of the aggregate, leaving the unspent outputs and the kernels that prove no coins were conjured. The chain keeps the accounting proof and throws away the dead middle. #bitcoin #privacy #cypherpunk

Money that expires and has opinions about what you buy isn't money. It's a coupon. #bitcoin #cypherpunk

Did you know? VeraCrypt can tuck a second encrypted volume inside the free space of a first — and because that free space is filled with random data when the outer volume is made, the hidden header and the hidden volume are indistinguishable from it. One password mounts the decoy; a different password mounts the hidden volume, and nothing on disk betrays that a second one exists. The goal is not unbreakable secrecy but deniability: make a secret look like noise before anyone thinks to ask. #VeraCrypt #privacy #cypherpunk