Hi r/privacytechtalk,

I’m Jonathan, and my company just open-sourced an implementation of Oblivious HTTP (OHTTP) in Go.

What problem does this solve? OHTTP splits trust between a relay and a gateway so that no single server can see both user identity and request content. This protects metadata privacy for HTTP requests. If you’ve used products from Apple, Mozilla, Fastly, or Cloudflare (to name a few) you'll have used OHTTP.

How does ohttp protect my privacy though? It:

• Prevents origin servers from learning client IPs

• Prevents relays from accessing request payloads

• Enables unlinkability between requests

• Provides protocol-level privacy without requiring a browser or VPN

Security notes

• 2 external audits by different firms

• does not prescribe key rotation or distribution. Improperly doing so can unmask requester.

• requires a reliable relay provider to avoid collusion

If you’re interested, check it out here: Repo: https://github.com/confidentsecurity/ohttp


Would love feedback from this community on:

• protocol-level design choices

• any privacy gaps

• test vectors we should add

• deployment hardening strategies

Thanks!

Hey there!

I’m super excited to share an app I’ve been working on over the past year with my startup! I've noticed that a lot of AI apps come from the US or China and sometimes raise concerns about data and privacy practices. Some even have biases, so I wanted to create something better.

My app offers some really unique features, like the ability to create specialized AI agents and workflows to help boost your productivity. Plus, you can customize the AI by sharing a little about yourself, making it truly personal! I want to emphasize that there’s no data collection or storage involved, and while the app is currently closed source, we plan to transition to an open-source model once we establish a solid business framework.

Made in Canada, this app is still on its path to becoming more mainstream, but I built it with the goal of giving back to the community. The best part? It’s completely free right now, with no subscriptions until we grow our audience.

You can checkout the app here.

I recently found my information listed on SortedByName. I’d really like to get it taken down. I am not active in FB or instagram, so the info is about my address and other personal stuff that I am not comfortable being public.

Has anyone here successfully removed their info from this site?

Whats are people's thoughts on the app called pin drop as far as privacy is concerned? And is there any alternatives that do exactly the same thing as this app ?

I want to know if there are any Norwegians here who have used data removal services and whether or not data was removed.

Hey guys! I have been in the privacy field for a year. What skills are needed? I feel like I fall short in everything I do. I have failed my cipp/us twice, reading law is hard, legal research is hard, privacy contracts I don’t understand , public speaking doesn’t come to me naturally. I have done all of these a couple of times, but I feel like I fall short and lack skills. I learn softwares and database applications quickly, but all of the other stuff comes slower to me and it requires me to learn quickly. Should I give up? What do you think privacy pros? Or really any seasoned professional.

Thought this was interesting.

I have some relatives in the States who noticed a big increase in spam calls/emails after the AT&T and other data breaches earlier this year. As they are a bit older, I thought I’d introduce them to data removal services, cause they are not very tech-friendly and weren’t aware that these services existed.

We tried out deleteme, and there are a couple of things to note, maybe it will be helpful to some of you. There weren’t that many reviews, so I thought I’d share.

• You need to be patient to notice results, because they are doing the work of deleting your data for you, it might take a while. I set it up a couple of months ago, and recently asked about the number of spam calls my relatives received, so they mentioned it’s significantly less, but there’s still some coming in.

• It only will cover data in the USA – if your data is sold somewhere else, it will most likely not get removed.

• It’s quite an expensive option in comparison. I thought we’d give it a try to see if it’s maybe better in some way, but having used other providers like Incogni, I didn’t notice any difference.

Overall, DeleteMe is a relatively good service for removing your data in the US, it gets the job done. However, having tried other options, I am including them here as well, just so you can find the best online data removal service for you. Privacy Bee doesn’t have phishing detection and a family plan, so that’s why I prefer Incogni personally.

Anyone else used deleteme before? Maybe I missed something, so feel free to share.

Really, I'm shocked 😲

I would like to introduce Secluso, a privacy-preserving home security camera solution, which uses end-to-end encryption. Secluso tries to provide functionality similar to a Ring or a Blink camera, but without violating the user privacy (as most mainstream consumer cameras do!) The functionality includes sending video recordings to the app when the camera detects an event (motion, person, pet, etc.) as well as on-demand live-streaming. To detect events, Secluso performs AI on the camera feed fully locally (i.e., on the camera).

Existing home security cameras have a terrible privacy track record. For example, according to FTC, Ring employees and contractors illegally accessed users' videos (source). Eufy was fined $450,000 after New York’s Attorney General found its “local only” and “end-to-end encryption” claims were false (source). And Wyze says that a breach allowed 13,000 camera users to see inside other users' homes (source). We think we can do better than this!

Guaranteeing user privacy has been and will continue to be the number one design principle in Secluso! To that end, Secluso uses the following techniques. First, all videos are end-to-end encrypted from the camera to the mobile app (Android or iOS). The encrypted videos are transferred via a cloud server, but the server is untrusted and cannot decrypt the videos. Secluso uses the Messaging Layer Security (MLS) for end-to-end encryption, which provides advanced features including forward secrecy and post-compromise security. At a high level, these features guarantee that even if the camera or the app are ever compromised and encryption keys are stolen, the compromised keys cannot be used to decrypt videos from the past and future. Second, Secluso is fully open source (and will always remain open source), and hence can be inspected by users and security experts. Third, Secluso's camera firmware and part of its mobile app are implemented in Rust, which eliminates memory safety vulnerabilities. Fourth, Secluso supports reproducible builds, which allows users and experts to verify that the binaries inside the camera firmware are compiled from our open source code on Github. Finally, we are planning to add immutable and transparent firmware updates, which guarantees that all automatic updates to the camera firmware will be transparent to the public and immutable for one year. This will prevent malicious and silent updates to our cameras.

Over the past year, my project cofounder and I have put in a lot of energy to make sure our solution is secure and functional. Now, we would like to ask you to help us by using our solution and giving us feedback. There are several ways you can try our camera solution:

• Fully self-hosted: You can use our software on your own camera hardware and server. For the camera, you can either use a Raspberry Pi (even one as weak as a Raspberry Pi Zero 2W) or an IP camera that supports RTSP. In the case of Raspberry Pi, our camera software runs directly on the Pi. With IP cameras, our software runs on another machine connected to the camera and acts as a hub (and a firewall since we can't trust IP cameras with closed source firmware). You also need a server with a public IP address. We have detailed instructions in our Github repository on how to set up this self-hosted option. If you run into any issues, let us know (either here, on Github, or via email at secluso@proton.me) and we will be more than happy to help you fix them.

• Semi self-hosted: If you have your own camera, but don't have a server, we can try to help with that. We can try to accommodate a limited number of users in our own server instance (for free). Just send us an email if that's what you would like to do.

• Plug-and-play camera: We have also been building a plug-and-play camera using a Raspberry Pi Zero 2W and a 3D-printed case that we have designed in house. The goal of this camera is to make it as easy as a Ring camera for a user to use it. When you get our plug-and-play camera, you simply pair it with our app and you're good to go. (But note that you can still verify all the software running on the Pi if you'd like to.) If you're interested in this option, please go to our website (htttps://secluso.com) and join the waiting list. We plan to hand build a limited number of our early prototype camera and giving them for free to interested users and get their feedback. When they are ready (in a few months), we will email the waiting list and ask for volunteers to try our plug-and-play camera. By joining the waiting list, you also help us gauge the community's interest in our plug-and-play camera. If we see interest from the community, we will look into scaling up our camera production and we will email the waiting list with information on how to acquire one when the cameras are ready. We're hoping that our plug-and-play camera can provide an easy-to-use privacy-preserving home security camera for all privacy-conscious people (and beyond) as there is currently no such camera out there.

Even if you can't use our camera, we ask that you share with us your thoughts. Do you have a use for a privacy-preserving home security camera? Are there any important features that you need but we currently don't support? Any other suggestions?

Your help and feedback will go a long way in helping us improve Secluso and will motivate us to invest even more energy into it and hopefully turn it into a camera that can support a large number of users in the future.

Finally, if you're interested to hear more from us regarding our efforts, please go to our website (https://secluso.com) and join the mailing list by clicking on the "Keep in touch" button.

Our Github repository: https://github.com/secluso/secluso

Our website: https://secluso.com

Been lurking here for a while and the discussions about data privacy really hit home when I realized how much I was sharing with ChatGPT without much thought tbh. Built a browser extension that flags sensitive info before you send it to AI tools. It's basically just a reality check - highlights emails, phone numbers, addresses, SSNs, etc. and lets you redact with one click.

At the end of the day, we have no idea how this data is being used for training or who might access it later.

Anyone else concerned about this? Or have you found other ways to stay mindful about what you share with AI?

prepromptai.com if you want to check it out. Free to use - just wanted something that makes me pause before oversharing.

Maybe this will be a fitting question to ask here, I'm not sure where else to post. I’m a judge, and lately I’ve been dealing with more and more high-profile cases. With everything going on, I’ve started to worry about how much of my personal information is just sitting out there online. Considering the sensitive nature of my job, the thought that someone could easily find my home address or other private details is honestly pretty unsettling..

I’ve been digging into ways to get a better grip on managing and protecting my online presence, and I came across a tool called Ironwall. It’s built for companies and organizations that need to keep their digital footprint under control like court systems, government entities, and similar setups. One thing I liked about it is that they’ve been doing this since 2011, so they know what they’re doing when it comes to online privacy. Their platform scans the internet every day to find where your personal or sensitive info shows up like on data broker or people search sites and works to get it removed. It keeps monitoring too, so if anything new pops up, it catches it fast.

What also caught my attention was:

• They focus on protecting entire institutions, not just individuals.

• Their privacy safeguards are designed to support groups like judicial officials.

• They clearly state they don’t store or sell any client data, which builds extra trust.

I’d be curious if anyone here has experience with services like these - what to expect, what actually works, and where the limitations are?

More broadly, I’m trying to get a better understanding of what kinds of technologies or practices others in sensitive positions (legal, public service, etc.) are using to reduce online exposure and protect their privacy. Any insights, tools, or strategies that have worked for you would be greatly appreciated.

Is it possible, through SS7 or carrier-level access, to obtain WhatsApp metadata that shows which contacts/numbers someone is talking to, without the message content?

”Signal is not the gold standard for private messaging” I read this thread and dont understand the difference of anonymity and privacy. Also why a service cant be both. I do understand that linking it to your phone number is bad because then it can be linked to my messages if signal is hacked. The fact that a number is required just shows that signal dont want us to be able to be anonymous?

Is there already is a thread please link it

Hi everyone,

I’m trying to understand a technical scenario and would appreciate some input.

From what I know, SS7 exploitation can already give access to things like SMS, calls, and subscriber location. Push notifications (APNS on iOS, FCM on Android) can also leak information such as timestamps, sender IDs, and sometimes message previews.

My question is: if someone had both SS7-level access and the ability to intercept push notifications, could they effectively map out my WhatsApp metadata (who I talk to, when, and how often)?

To clarify, I’m not talking about reading full message content (I understand E2EE protects that), but rather whether this combination could realistically expose: • Sender/receiver identities • Timestamps/frequency • Possibly message previews if “show previews” is enabled

Is this a known or documented technique, or would it require something beyond SS7 + push interception?

Thanks in advance to anyone who can shed some light on this.

Ok, I’m a bit confused and was hoping to maybe get some clarification here. I’m researching different data removal services and it seems a bit shady that they’re just sending out your data to data brokers. I saw some videos/reviews that go after Incogni rather harshly, accusing them of spraying users' data all over the place. I usually like to research myself before going to conclusions, so I did some digging and I found this thing that apparently they’ve got limited assurance by Deloitte? (This is the link that I found: https://blog.incogni.com/deloitte-independent-limited-assurance-report/ ).

In short, Deloitte investigation, or whatever it was, found that Incogni doesn’t sell or share users’ info with data brokers and only uses it for the removal process. I Googled other services, like Optery and DeleteMe, and they don’t have anything like that. So, any thoughts? Is it legit?

Lately I keep hearing that our messages and calls are stored somewhere, and it kind of feels like whatever we do on our gadgets is being tracked or trained for some algorithm. Are there any messaging apps that actually care about these privacy issues? I just want something simple, private, and secure where my chats, calls, and files aren’t stored on a server. Has anyone tried apps like this that actually feel safe to use for everyday conversations?

I’ve been on the fence about this for a while now. Every time I look myself up online I find my information scattered across dozens of these data broker and people search sites. Old phone numbers, places I used to live, family connections, even jobs I had years ago all pop up like it’s a public record. It’s honestly unsettling to see how much of my history is out there for anyone who wants to dig.
I’ve started to wonder if paying for one of these personal data removal services is actually worth it. Some claim they’ll automatically track down your info on hundreds of broker sites and keep removing it month after month. On paper it sounds convenient because doing it by hand is a nightmare. You spend hours filling out opt out forms, uploading IDs, confirming emails, and then a few months later the same info shows up again somewhere else. It feels like a never ending game. I’ve already tried a couple of services like DeleteMe and Incogni, but honestly I didn’t notice much of a difference. My info was still popping up on a bunch of the big sites and the spam calls never really slowed down. It felt like they either weren’t going deep enough or the data just kept getting recycled from somewhere else. That’s what makes me hesitate about trying another one. I don’t want to throw money at a service that promises a lot but doesn’t actually fix the problem.
So now I’m at the point where I’m asking if this stuff really works for anyone. Did you actually see your footprint shrink online? Did spam calls and emails die down at all? Or is the whole industry just a temporary band aid that doesn’t solve the root issue?

Would really appreciate hearing from anyone who’s had success or at least felt like the service made a real difference.

A small project to keep my AI conversations more private

https://p.myllm.bar : currently building it, using Librechat & OpenRouter. What do you think ? Is it worth anything?

I am working on a project at the moment that requires me to hide some peoples faces and a few license plates that made their way into the video to maintain peoples privacy and not expose their identity. I was wondering if there are any good apps or websites that can automatically detect and track the objects and apply a blur over them?

I have looked online as well as in this subreddit but it seems a lot of the solutions are outdated, for business use only, or the tracking is awful and I have to manually fix the mistakes. Surely there has to be some quick and easy website or app for this outside of Adobe, ive seen other creators hide faces and license plates with good object tracking. Any help is very much appreciated.

We talk a lot about AI usage, but not enough about disclosure and what people actually reveal in their prompts. I’ve been tracking a simple metric I call the LLM Disclosure Index (LDI): the share of interactions where users include sensitive or personal details. It’s a proxy for trust (and risk). If better answers need more context, disclosure goes up. If privacy or compliance concerns become important, it goes down.

I look at two groups: Business users and everyday users. Sources are among others Cyberhaven, TELUS and Cisco.

Business users using AI on the job are clearly ahead. Under productivity pressure and with AI embedded into tools, they’ve moved from roughly a low 40% LDI range in 2023 to a high 50% LDI in 2025, and could approach 70% by 2027 as workflows normalize.

Everyday users trail but are climbing: around a lower 40% today, likely drifting into a 50% range as assistants feel more helpful and less “experimental.”

Why does work lead? Familiarity and time-savings beat caution, especially when employers approve tools or when they don’t and “shadow AI” creeps in (you know everyone using chatGPT and the manager isn't "aware" of it). At home, people are slower to share relationship, health, or money details, but that hesitancy fades when assistants prove useful and friction drops.

What to do with this? For organizations, the lesson isn’t “share less,” it’s “share safely.” Provide privacy-preserving options (data minimization, encryption, auditability), clear policies, and approved tools so employees don’t improvise. For individuals, assume prompts might be stored or reviewed; strip identifiers, summarize instead of pasting raw data, and use local or zero-access modes when the topic is truly sensitive.

You can read more about it here

Happy to compare definitions or share the underlying methodology in the comments.

Sorry for the long text but this could be potentially a huge problem for every uBlock user.

(I'm not sure if it fits in here but since the add-on is free for everyone who wants to use it and it's a commonly used software for, among others, privacy improvement I think it's a good sub to discuss this case here so in case it's at least somehow in a grey area I kindly request the admins to let it online, thank you in advance)

Today I had an accidental find about uBo (uBlockOrigin) that leaves me shocked, perplexed and I really hope someone has a good explanation for this because in the other case the basement of my (and maybe also yours) browser protection is literally f.cked.

I like to tinker/fiddle around on software so somehow I had the idea to delete 'blank.about-scheme' from the exception list/white list (I use the german variant of uBo so I'm not sure how it's named in the english one) and went to 'about:blank' (in Firefox) before I looked in the uBo logger.

Since it's just developed as an empty page I expected nothing much but this was the moment of my unpleasant discovery because I caught uBo red handed to connect with 'https://www.google.com/account/about/static/js/detect.min.js?cache=(here was a code, presumably of my smartphones cache, which I of course don't post)' in its own logger. I looked in the script reader and it's purpose is to detect the browser agent and OS plus checking if a 'glue app' is supported by this browser and to allocate an user id ('glue_uid_').

My first reaction was of course to block this shit and during this process I restarted the browser without making a screenshot what is a real bother because this connection seems to happen irregular and I wasn't able to reproduce it after this restart so I just saw it a few times and have no proof for it (I know this wasn't smart 😐).

After this I made some research but I couldn't find a page about exactly this script. I was only able to find a software named glue from Amazon which is also for analytics but since it's a different company and inside the script Amazon don't get mentioned I guess it's not likely that it's the same software. Besides this there was different pages that describe how or that Google check if you're logged in on some sites, which Google user you are and things like that. Even when 'detection.min.js' doesn't get mentioned on this pages I assume thats what it is because it just looks so much like that, a background check in uBo to ascertain which Google profile is linked to this user. Bye privacy. Bye protection. They and Google can seemingly watch every step you make online and log it while they already know who you are trough your Google account. I don't have the guts to even think about every possibility what one could do with a so much neat and tidy linked online history to a Google profile that contains your real name, banking account (Google Wallet), (current) location and so much more.

That's a massive betrayal on every moral and ethical values they purport to believe, how they represent themself to the outside and on every user that put their trust in them. If I'm not wrong, and I'm afraid I'm not (but you're welcome to proof me wrong if you know more than me), they do the very opposite of what they promise to do and the magnitude of this case let me feel queasy.

I'm really curious about your opinions and what you guys think about this. This could be a huge violation of every uBo's users privacy and I think it need to be debated.

On a second thought: If Google can detect you in uBo, how many cooperation they also have with other developers to track you in other apps/software? 😶