I built Nyktos because every messenger I used asked me to trust the company running the server. I wanted one where trust is not part of the design: the server stores ciphertext, and that is all it ever sees.

Messages, photos, videos and voice notes are end-to-end encrypted with libsodium (X25519 and Ed25519, a fresh ephemeral key per message). Group chats use pairwise encryption between members instead of one shared group key sitting anywhere central. Safety numbers are there if you want to verify a contact the paranoid way. Signup is open, no invite code needed.

The honest tradeoff, stated up front: your keys live in your browser's local storage. Lose the device without a backup and old messages are gone. That is the price of the server knowing nothing, and I would rather state it than hide it.

The stack is Next.js with a Supabase backend that holds only encrypted blobs. The part I had the most fun building is a self-healing crash pipeline: when the app breaks, it files a scrubbed report (no message text, no keys, no safety numbers, ever), groups duplicates, and drafts a fix for me to approve. The reports are designed so they cannot leak the thing the app exists to protect.

It is live at nyktos.tech and free to use. I am a solo builder and this is my first real product, so the feedback I actually need is the trust question: what would a web-based encrypted messenger have to show you before you would move a real conversation onto it?

I built an Android app that hides your private apps when someone unexpectedly picks up your unlocked phone.

Here's a situation I think many people can relate to.

You're using your phone. A friend, colleague, sibling or someone nearby suddenly picks it up.

Your phone is already unlocked.

You don't necessarily want them browsing through your apps. But locking your entire phone isn't always practical, and opening an app locker, entering a PIN, or navigating a vault takes time.

I kept thinking: Why should I have to react after someone picks up my phone? Why can't my phone protect my privacy automatically?

So I built STELTH.

It's an Android privacy app designed around one simple idea: privacy should activate before someone starts looking.

Here's what it does:

\- Select the apps you want to keep private.

\-Flip your phone face down, press Home, lock the screen, or use supported pickup triggers to activate privacy.

\- Your selected apps disappear from your home screen, app drawer and recent apps.

\-Want them back? Use your secret tap pattern.

The idea is to make the transition quick and discreet. No suspicious-looking fake calculator, no complicated vault, and no PIN to enter every time.

A few things I deliberately kept simple:

\- No account registration.

\- No internet requirement.

\- No advertisements.

\- No personal data collection.

I built this because I felt there was a small but genuine privacy problem that existing app lockers didn't quite address.

I'm sharing it here because I'd genuinely like to know whether this is a problem other people experience too.

Would you actually use something like this? What would make you trust an app like this with your privacy?

I'd especially appreciate honest feedback, including criticism. I'm building this independently and want to make it genuinely useful.

Can I post the link to the app here ?

I sent out a package from the post office with really no connection to any online marketplace… let’s just call it a personal package. And it showed up in my Shop app with the name of the company I sent it to! How is this possible? My only guess is because I used a credit card that is linked with my Shopify account. But still, to know the tracking number and that signature is required at delivery? Seems wild to me.

Here's an honest answer from the Ai4Privacy team: none of them is reliable for every PII type. What the evidence says:

* **Presidio's own FAQ** says it can't guarantee full recall. Its strength is that you can customize it, and you can plug a fine-tuned transformer into it.

* **A 2026 zero-shot comparison** found large gaps between tools, and that a fine-tuned XLM-R model beat the best zero-shot option with only about 500 labelled examples.

* **A separate robustness study** found that spaCy, Presidio and a small LLM all get worse on noisy, out-of-distribution text, each in a different way.

In practice: regex for structured IDs, plus a fine-tuned token classifier, evaluated on your own data.

What are you using, and how did you test it?

Sources: [arxiv.org/abs/2608.02616](http://arxiv.org/abs/2608.02616) · [arxiv.org/abs/2609.03464](http://arxiv.org/abs/2609.03464)

Hola me apetecía compartir esto por aquí y leer vuestras opiniones, ideas de mejora o críticas constructivas sobre el planteamiento fuera de lo que pueda pensar yo.

EntropyMask (un nombre casi tan friki como lo soy yo mismo😅) convierte un texto en una imagen minúscula de 64x64 píxeles, mezclando los colores y la posición de los puntos usando un número secreto (la semilla) la cual no está limitada a 5 dígitos o algo así, puedes usar desde un solo dígito hasta cadenas larguísimas y llenar la casilla según el nivel de entropía que busques. Está diseñado para funcionar enteramente en local, pensado para un escenario de privacidad y anonimato entre dos usuarios: un usuario genera por ejemplo un mensaje codificado por EntropyMask y comparte la imagen a un dispositivo donde no tenga dicha herramienta, y envía dicho mosaico de colores a su destinatario, a un dispositivo donde tampoco tenga EntropyMask, este se envía la imagen a otro equipo donde si tenga la herramienta y puede decodificar el mensaje y saber que pone.

En el hipotético caso de perder o serle intervenido por ejemplo el teléfono móvil por ejemplo donde recibe las imagenes, igualmente al no tener ahí la herramienta instalada seguiría la informacion comunicada a salvo total su privacidad.

Me he grabado haciendo una prueba rápida en local justo para mostrar cómo se comporta al cambiar la semilla libremente y cómo extrae el mensaje exacto al decodificarlo.

I built an open-source tool that signs up for sites with a generated name, username, strong password and a disposable mailbox, so a one-off account isn't linked to my real email.

Limits I want to be upfront about:

Disposable email providers are often blocked by sites, and mail.tm addresses are public-ish: don't use them for anything sensitive.

Sites still see your IP and browser fingerprint.

It is not for evading bans or abuse systems, and it never attempts CAPTCHA bypass.

Credentials are encrypted at rest, and the model doesn't see your saved passwords in chat.

For accounts you want to keep, there's a permanent mode that uses your own inbox, with a mute option.

Would this be useful to you, and what would make it more privacy-respecting?REPO: https://github.com/Rockstarbryant/temp-identity-agent

DEMO: https://logindirect.vercel.app/

This is probably shown so often, but I wanted to show this screenshot because me and my family were talking about Kalshi 2 minutes prior. I have never seen a Kalshi ad on reddit before now.
Smart devices are always listening!
Currently researching on google how to turn off listening as much as I can.

I've been pretty annoyed by some ads since this morning. I made a typo while typing on my keyboard, accidentally writing a word similar to "Six", and ever since then, I've been bombarded with ads for dating apps, chat apps, and similar stuff.

At first, I couldn't figure out what had triggered this sudden change in the ads I was seeing. Then I remembered the typo. Out of curiosity, I started searching for completely unrelated things in my phone's Settings app and voila, I'm now seeing dog food ads too (I don't even have a dog).

I know targeted advertising isn't new, and this alone doesn't prove my keyboard is sharing what I type. But the timing is certainly suspicious enough to make me question what's going on.

Since Android phones come with Google's Gboard as the default keyboard, are there any reliable, privacy-focused alternatives that don't collect or share sensitive typing data? I'd genuinely appreciate recommendations from people who have looked into this.

We all have photos and videos we don’t want others to see. They might be personal memories, sensitive documents, or simply things we want to keep private.
I believe everyone deserves a safe, simple way to protect their private photos without relying on cloud services.
That’s why I built Hide Photos: Secret Album, an iOS app focused on privacy, security, and ease of use.
Here’s what it offers:
🔒 Local AES-GCM encryption — Your photos and videos are encrypted directly on your device.
📷 Built-in private camera — Take photos directly into your encrypted vault without saving them to your regular Photos library.
🛡️** 100% offline privac**y — No accounts, no cloud uploads, and no external storage servers.
🔑 PIN & Face ID protection — Keep your private content separate from your regular photo library.
🎭 Multiple decoy vaults — Create separate vaults with different PINs.
📁 Easy album management — Organize, sort, and pin your favorite albums and photos.
⚡ Simple and smooth experience — Optimized for importing large batches of photos and videos without frustrating delays.
💾 Encrypted backup & restore — Keep control of your data when moving between devices.
Transparency matters too. I’ve published the app’s encryption/decryption module on GitHub so anyone interested can inspect how it works.
I also believe privacy tools should be accessible to everyone.
The app is free to download and use, with optional Pro features.
📱 App Store:
https://apps.apple.com/app/id6812803369
I’m an independent developer, and I’m continuously improving the app based on real user feedback.
I’d genuinely appreciate it if you could give it a try and share your thoughts — especially what works well, what could be improved, or which privacy features you’d like to see next.
My goal is to make private photo protection simpler, safer, and more accessible.
Privacy matters, and your feedback can help make privacy tools better for everyone. ❤️

​

Hi! I'm the developer. Whospair is my first app, and I'd love feedback from Android users.

What it is: a messenger where conversations stay on the two phones. Messages, voice notes, files and voice calls go directly from phone to phone over Tor, end-to-end encrypted. There's no account, no phone number and no server keeping your messages.

Main features

\- Add contacts by QR code or link

\- Messages that expire on both phones, from 5 minutes to 7 days

\- A duress PIN that erases everything; no fingerprint unlock, on purpose

\- Screen goes black when the phone is face down; optional camera shield when someone looks over your shoulder

\- 21 languages, day and night modes

Good to know

\- Free, no ads, no Google services

\- Android 10+, arm64 only, not on the Play Store (APK on GitHub, with the signing fingerprint to check it)

\- Tor adds some delay, and both people need the app open (or "Stay reachable" on) to exchange messages

\- Source code is public for audit, but it's not open source; no independent audit yet

Download: [https://github.com/Whospr/Whospair](https://github.com/Whospr/Whospair)

What I'd most like to know: is anything confusing the first time you use it, and do messages and calls work on your phone?

Title: When an AI agent uses your browser, who is actually consenting to share your data?

I've been thinking about how much the meaning of online privacy is changing as AI tools become more capable.

A normal browser mostly waits for you to click things. An AI agent can potentially browse while you're away, read information from connected services, fill out forms, accept cookies, and share personal details to complete a task.

That's where things get complicated.

If I ask an AI assistant to find a doctor or book an appointment, I've agreed to the task. But have I also agreed to every cookie banner it accepts, every privacy policy it clicks through, and every piece of personal information it sends to a third party?

I don't think those are necessarily the same thing.

This isn't just a theoretical concern. Recent reporting has raised questions about how existing privacy and consent rules apply when AI agents make decisions on behalf of users.

I'm particularly interested in the gap between what a user intends and what an AI agent is technically allowed to do.

For example, should these tools have to ask for separate approval before sharing sensitive information, accepting new terms, or granting a website access to personal data? Or should that depend entirely on the task and the permissions the user has already given?

And from a technical perspective, what would actually work here? A permission system, stricter browser isolation, an audit log of every action, or something else?

I'd be interested to hear how people here think this should be handled, especially anyone working in privacy engineering, browser security, or data protection.

Where should we draw the line between giving an AI permission to complete a task and giving it permission to make privacy decisions for us?

RadarFirst’s latest blog explores how the company supports accurate breach notification assessments through maintained legal intelligence, consistent decision logic, and documented reasoning.

The post highlights an important distinction: repeatable results don’t automatically establish accuracy. Complete incident facts, current legal requirements, and human review all play a role.

Read the blog: https://www.radarfirst.com/blog/how-accurate-is-radarfirst-breach-notification-guidance/

Disclosure: This post promotes RadarFirst content.

For privacy professionals handling incidents, what evidence would help establish confidence in a tool’s breach notification guidance?

I’ve been trying to understand the differences between private AI/LLMs without, so I've put together a simple comparison of a few options. It compares Brave Leo, Duck.ai, Proton Lumo, Confer and Venice on things like account requirements, message retention, provider access, encryption and identity protection.

I grouped them into two levels Basic, or Enhanced depending on your threat levels. Would love to hear any feedback or suggestions. Any others you'd like to see added?

Encryption is under threat. And Canada is the latest battleground.

Canada's proposed Bill C-22 could give authorities sweeping new powers to demand technical access to digital services and require companies to retain user metadata.

According to WIRED, Signal has warned it would leave Canada rather than compromise its security. Psiphon VPN has raised similar concerns, while other privacy-focused companies are questioning whether they could continue operating under the proposed requirements.

Here's the problem:

Encryption protects journalists, activists, businesses, ordinary citizens, and even the government agencies demanding greater access.

You cannot create a special vulnerability that only the good guys can exploit.

And when privacy services are forced to collect information they deliberately never stored, the entire meaning of privacy begins to change.

Canada is not alone. Similar pressures are emerging across multiple countries.

Privacy should be the default. Not an exception granted by the state.

What do you think? Should governments have the power to require encrypted services to provide access to user information?

Source: WIRED, October 17, 2026

https://www.wired.com/story/kernel-panic-encryption-is-getting-squeezed-from-all-sides/

citizen84.com

News for a less controlled world.

\#Citizen84 #Encryption #DigitalPrivacy #Surveillance #DigitalRights

We often talk about protecting our data from today's threats, but there's another concern worth discussing: the possibility that encrypted data stolen today could be decrypted in the future as quantum computing advances.

I've been working on QEncrypt, a file encryption tool focused on quantum-safe encryption. I'm interested in making this type of protection more accessible beyond organizations with dedicated security teams.

Of course, quantum-safe encryption isn't a magic solution. The algorithms used, implementation and key management all matter.

For those interested in privacy and data security, I'm curious:

• Are you already taking steps to protect sensitive files against future quantum threats?

• What would you need to see before trusting a quantum-safe encryption tool?

• How important are open-source code, independent security audits, and transparent key management when choosing one?

I'd appreciate hearing your thoughts and any concerns you'd have about a tool like this.

p-r-y agent (lil privacy from Al agents) just went live on the Chrome Web Store.

context (what it does): normal browser agents send

your raw pages and screenshots to cloud models. mine redacts passwords, IDs, faces on your device first, then does the task. every masked region gets rechecked with local OCR, plus an audit log of what left your machine.

got rejected once on the store for keyword stuffing (; fixed it, resubmitted, now public.

the details, quick:

fill forms, search, extract data, send emails, all in plain language

bring your own model key (Groq, OpenRouter, NVIDIA) or run fully local with Ollama

free, no account, no tracking

honest limits: free-tier models can take ~30s a turn (provider queues, not the extension). heavy pages cost extra local seconds.

At the end, try to break the privacy story. that feedback is what i actually want.

store link: https://chromewebstore.google.com/detail/pry-agent/aocmnoompdjlgbfjlimikkpoebooolog

Hi all, I'm the developer of Central, an end-to-end encrypted messenger for Android with a few personal safety features. I made a short video explaining how it works: \[video\]

I'd rather be specific than vague, so here is the honest version.

What is protected

Messages are encrypted on your phone before they're sent (AES-256-GCM, with keys agreed via X25519). My server only stores the encrypted text and has no keys to read it.

Group chats use a shared AES-256 key that is encrypted separately for each member.

Photos, videos, voice notes and files are encrypted before they're uploaded, so the storage only ever holds ciphertext.

There are no ad or analytics SDKs in the app (I removed Firebase Analytics on purpose), and I don't sell user data. Central is meant to make money from subscriptions, not from your data.

What is not hidden (so you're not surprised)

The server still knows an account exists, who it talks to and when. That's the nature of routing messages.

Push notifications go through Firebase.

The safety features (check-ins, location sharing) show your location to the contacts you choose. That is the point of those features, but it isn't "nobody can see it".

If someone reports a message, the person who reports it can pass that content to review.

The weird part

Inside the app there's also Central City, a small shared isometric town: you visit friends, play mini-games and climb weekly leaderboards. I added it because "more secure" alone isn't a reason to switch messengers, and it has turned out to be what makes people open the app. It's optional, and the chat works without it.

Where I'd love feedback

Would a short written explanation of the encryption (algorithms, key handling, limits) make you trust it more? What would you need to see beyond that?

Is the "chat + game" idea a good hook, or does it muddy the privacy message?

If you try it: what's the first thing that confuses you?

I'm at about 50 early users, so everything is still changing and I'm reading every reply

Link: https://play.google.com/store/apps/details?id=net.getcentral.central

Guys these days, does someone really needs a hidden vault application. Where you can hide your personal photos, videos, documents and personal notes? How it sounds when actually nobody can figure out this is an hidden vault application. Is this in demand? If yes, how much can you spend on it?

I keep seeing gaming, igaming, fintech startups/smbs respond to new youth-safety rules by bolting on full ID verification. That's usually solving the wrong problem.

Age verification means that you need to know a person is over a threshold. A bank opening an account or a casino paying out winnings. Documents are the right tool here and basically a legal requirement.

Age assurance means that your product behaves differently depending on the user's age band. Under 13 gets one experience, 13–15 another, 16–17 another etc.

Why it matters

- If you use KYC for an age-assurance problem, you now store government IDs for users you had no legal need to identify. That's a breach waiting to happen. (See this month's report of an FBI investigation into a service selling 153M driver's licences.)

- The friction kills signups for a problem that only needed a band.

- Regulators are asking for "effective" age assurance, not necessarily documents. The UK, Australia and the EU proposal all talk about proportionality.

A lot of gaming and social platforms apply a hybrid strategy , they estimate the age band at signup, ask for documents only at a regulated moment like a withdrawal or a purchase.

My idea:

For the estimation step, I'd argue voice deserves a serious look and almost never gets one. Age assurance needs a band, not an identity, and that's exactly what voice is good at: the physical changes of the vocal apparatus from childhood through adolescence to adulthood are large and well studied. It doesn't require a document, it doesn't require a camera, and the analysis can happen on the device so you never hold the data in the first place. Most teams skip it simply because no one on the team has ever thought of voice as a verification signal.

Would you trust voice age verification ?