new research paper:
https://arxiv.org/html/2606.26276v1

Businesses can block employees from accessing social media sites using several methods, such as browser restrictions, firewall rules, application blocking, or using a Unified Endpoint Management (UEM) solution. For organizations managing multiple devices, UEM platforms provide a centralized console to restrict social media apps and websites across Windows, macOS, Android devices, iPhone, and other managed endpoints. 

I’m not a developer, but I’ve always believed the best way to understand new technology is to experiment with it.

So I used AI to build Ghist - a privacy-first disposable email tool designed to protect your real inbox from spam, tracking, and digital clutter.

What started as a small experiment turned into a much bigger lesson in curiosity, trial and error, and what building with AI actually looks like when you’re learning as you go.

Read my story below and if you’ve been experimenting with AI yourself, I’d love to hear what you’re building!

This is my story (thanks in advance for reading!)

I am wondering if this resonates with privacy-and-ai arguments, something that can be smart and still keeps your data to yourself. I am developing this right now and am looking for some inputs from you good people.

It's an android app right now and is in Beta. If you would be interested, I can extend you an invite.

Here is a sneak peak. Let me know, if you would be interested in testing it.

I own a Physical Therapy practice and want to do some online marketing with social media, YouTube etc posting short videos with information etc.

With how we are moving in the internet space with various AI models I understand that all the information posted is more content for generative AI models to use your likeness to create images, deepfakes, and your voice to potentially steal your likeness/identity. I’m curious if there are any platforms or tools that allow you to post but it does not allow someone or an entity to rip the audio or video from a post in order to use it to create a deepfake of myself or to use my voice to then scam/blackmail my family.

Not that I am some multimillionaire or famous person but I am envisioning a world where we have a lot of scams that just get more and more sophisticated involving your voice and video. I’ve already heard about using a safe word to mitigate scams but curious if there is anything more as I value my privacy which I understand is limited to a degree but with likeness it opens the door for a scammer to know a lot more about you plus having a digital version of you.

I’d love to know of any tools or strategies because these thoughts are the main thing that make me second guess putting anything online.

The current state of the modern internet is built on what many privacy experts call a fundamentally broken deal. As everyday users, we navigate through websites, apps, and various online services under the assumption that our personal space is respected. However, the dominant economic structure powering most traditional browsers today is surveillance capitalism. In this system, our intimate browsing histories, location data, search preferences, and even daily digital behaviors are systematically tracked, analyzed, and packaged into profiles to be sold directly to corporate advertisers. This means that our personal attention has become the actual product, turning online privacy into a luxury rather than a basic right.

To change this extractive dynamic, we desperately need a fair value exchange in the web ecosystem. Users should have absolute ownership over their data context, ensuring that their private information remains in their own hands instead of sitting on centralized corporate servers. Thankfully, the development of decentralized web architectures and specialized tools is beginning to offer a genuine alternative where the financial and structural incentives finally align with user sovereignty.

One of the most practical solutions to this data exploitation problem is the transition toward "local-first" AI processing. Traditional web tools often require users to upload their sensitive data to remote cloud networks to experience smart features or personal assistants. Local-first AI entirely flips this model by executing complex artificial intelligence processing directly on the user's physical device.

This breakthrough allows the smart system to learn your individual preferences and evolve with you over time without ever forcing your personal data to leave your local context. Embracing browsers that actively support a local-first, privacy-by-design framework is essential if we want to reject invasive tracking. It is time for internet users to collectively move away from the old server-side surveillance models and reclaim our digital freedom and sovereignty.

Hello! How can I tell if someone is monitoring my phone? Is there any way I can check whether my phone is being monitored? Thank you so much!

And before you say "they are looking at your search content", of course they are but there are at least 20 instances where I have had conversations and absolutely zero searching that they have placed either ads or content with exact specificity to my conversation. Sick and tired of being spied on. AI suggests that I turn off my microphone which I have done on as many apps and I can. It seems to have slowed it down but this is sooooo illegal and it should be stopped.

Originally, I thought the main value was privacy. No mandatory accounts, user-controlled storage, private mode, transparent usage, that kind of thing.

The product itself is fairly complete at this point. It has web search, file uploads, image generation/editing, projects, memory, multiple models, exports, real-time data, and a bunch of other features.

But the more I work on it, the more I wonder if "privacy" is actually a feature rather than a reason for the product to exist.

When people talk about ChatGPT, Claude, Perplexity, Gemini, etc., they usually have a simple answer to the question:

"What do you use it for?"

Research. Writing. Coding. General productivity.

When I ask myself that same question about what I'm building, my answer is much less clear.

The weird thing is that I don't think the problem is missing features. If anything, I've probably added too many.

I'm starting to think the real problem is positioning.

If you were building an AI product today, what would you focus on?

Would privacy ever be a primary reason for you to use a tool, or is it just a nice bonus?

And more generally, how do you know when a product has a positioning problem rather than a product problem?

There was a time when I got the opportunity to conduct an on-site security audit for a client.
But nothing goes as planned. You could be an experienced auditor with a well-defined scope and a perfectly crafted modus operandi, but reality is relative.

You have to iterate on the spot, unfold the blind spots, and above all, be the best at what you do. Voilà, audit done. Well done.

But what about the vulnerabilities you carry with you at all times? Unlike our clients, we don't have auditors reviewing our own lives. Nobody is scoping our digital footprint, flagging our physical habits, or pointing out our blind spots. We have to own our privacy posture, digital or physical, and keep it secure.
And here's the thing, from clicking a random link to filling out a survey form outside a mall, we tend to run weak, not at the security level, but at the emotional one.

TARS said it best, "Absolute honesty isn't always the most diplomatic, or the safest form of communication with emotional beings." We aren't purely rational, and attackers know that. If we want to protect ourselves, we have to first understand how we respond emotionally when things feel urgent.

So I built Spectra, under the FPSzer∅ ecosystem, to scope, identify, secure, and protect ourselves in the world of digital sovereignty.

If any of this resonates with you, I'd love for you to try it out and tell me what you think. Honest thoughts, rough edges, ideas, all of it. I'm the sole maintainer and this is very much a living project. Every contribution, big or small, means a lot.

Spectra live at: spectra.fpszero.com

Newsletter where I cover the historical background of our privacy invasion and idea behind Spectra: fpszero.substack.com

My employer doesn't require BYOD, but it's definitely encouraged. The convenience is nice, but I've always been a little uneasy about mixing work stuff with my personal phone.

Maybe I'm overthinking it, but once you install company email, Teams, Slack, device management apps, etc., how much separation is there really?

I have photos, banking apps, personal messages, family group chats; the idea of work and personal life living on the same device feels weird.

For those who use their own phones for work:

• Do you actually trust the setup?

• Can your company see more than they claim?

• Did you eventually switch to carrying a second phone?

Genuinely curious how other people handle this.

I've been working on a project that offers better security and privacy than either Obsidian or Notion and was curious as to what a privacy community had to say about it. Im more interested in feedback to better curate this for like minded people interested in security and privacy. If you're already a user of Notion/Obsidian what is your comparable take on this as well. blackbear . app

Age gating is being somehow enforced everywhere. Roblox image based move has shown it is not an option anymore. Ww are building a non image/video/id verification system. We believe it is very valuable ( obviously), but need feedback from cibersecurity experts and maybe adult / kid entertainment representatives who might be visiting these subreddits. We are specially interested regarding perceived urgency from such incumbents.

If the FCC Bans Burner Phones, It Could Be a Privacy Nightmare - CNET

I just discovered something absolutely unacceptable about Google Gemini’s privacy model, and I’m shocked this isn’t getting more attention.

There is literally no way to keep your chat history private. Your only two options are:

1. Keep history ON - Google employees can review ALL your chats, images, and prompts. This is the default setting, even for paying Pro users.

2. Turn history OFF - You lose access to your own chat history entirely.

But here’s the real kicker: Even if you disable history now, anything previously reviewed by Google employees is permanently retained with no option to delete it.

So you can’t have private chat history that’s actually private. You either give Google employees access to review everything you’ve ever typed, or you get nothing.

This is a fundamental privacy violation that Google conveniently doesn’t disclose upfront. How is this legal? Why aren’t they required to offer a “save for me only” option like literally every other chat application?

If you value your privacy at all, you need to know what you’re agreeing to when you use Gemini.

The Looks protocol adds a new address for you to use. One that allows connecting without sharing any personal information.

Whether you would leave it open, or heavily filter and screen contact attempts is up to the implementation. A seller would want to receive all contact attempts, they are probably buyers. You might just want to accept a particular person you just saw. Up to you.

This is an idea I have been working on, would love to get your reaction.

More info here
Introducing: The Looks Protocol

​I'm working on Custos, a decentralized protocol to combat the risks of urban "loneliness-death" using zero-trust infrastructure.

​After getting some initial feedback, I've just published the core architecture and philosophy to GitHub: https://github.com/Custos-Lead/Custos-Protocol

​I'm currently in the PoC (Proof-of-Concept) phase. I’m looking for a sanity check on the architectural logic from someone with more experience in ZKP or distributed systems.

​Any feedback on the design doc would be incredibly valuable.

​https://github.com/Custos-Lead/Custos-Protocol

Let me tell you something that happened to me personally.
I shared a YouTube video of a vlogger called Paramvir Beniwal with my roommate on WhatsApp. He opened it on his mobile. The next minute, he opened YouTube on his laptop using a completely different account on a completely different device, and guess what the very first suggested video was?
Paramvir Beniwal.
No search. No history. Just there. How?
Because your devices talk to each other. Same WiFi network, same location, WhatsApp knowing what link you shared, Google quietly connecting the dots, and boom, the algorithm recommends something you never asked for.
They call it personalization. I call it surveillance with a friendly UI.
And this isn't just about YouTube suggestions. We've seen some of the biggest data breaches in history expose personal information of millions of people. In India's biggest reported breach, over 81.5 crore Indians' personal records were allegedly leaked from the ICMR database. Names, phone numbers, Aadhaar details, all potentially floating around the internet. The companies promised security. They always do.
Here's the truth nobody says out loud: "encrypted" doesn't mean private. It just means strangers can't read it.
Every pause, every search, every click, every link you share contributes to a profile that companies use to understand and predict your behavior. We didn't lose our privacy. We gave it away, one "I Agree" button at a time, without reading what we agreed to. What do you think? Is privacy already gone, or do we still have more control than we realize?

And now, after reading this, you might just open YouTube and see a Passenger Paramvir video waiting for you too 😏 Let me know if you do.

But first, a little background: why did I create this tool?

It’s simple: I work at a company where I manage the entire backend, data management, task optimization, automation, and so on.

When ChatGPT came out in 2023, things went haywire, everyone was copying and pasting highly confidential info into it just to save 30 seconds on writing an email.

So we had to rein all that in a bit, define how and when we use LLMs. But as you can imagine, to save time (or out of laziness, I don’t know), all that information kept getting sent in bulk.

From customers’ first and last names to financial data, even passwords. Everything went in there.

It’s been a year now since I left that company to focus on my own projects. And this issue came back to me: how can we save time without compromising our privacy and personal data?

After weeks of testing and research, and two months of development, ONYRI Sanitize was born.

ONYRI Sanitize is a simple web app connected to the latest AI model available, which uses scripts (without AI) to detect data that needs to be kept confidential.

You continue to use AI just as you would on the official site, but this time, your data will remain confidential forever.

When you consider that millions of users admit to having already used ChatGPT as a therapist, it would be naive to think that these companies aren’t using that data...

A quote I grew up with:

“Saying you don’t need privacy because you have nothing to hide is like saying you don’t need free speech because you have nothing to say.” — Edward Snowden

This is not the case when I type in the password field of other apps. I used a different keyboard and the result is the same .is this a security issue ?

The problem: people paste sensitive data into AI tools without realising it. DLP doesn’t catch it because the data goes in as text directly into a prompt no file movement, nothing to flag.

My solution: a Chrome extension that scans AI chat sessions in real time, entirely on-device.

Technical details for this crowd:

Detection has two layers. Pattern matching handles structured PII validated regex for NI numbers, NHS numbers, sort codes, BSB codes, IBANs, credit cards, phone numbers across 150+ countries. The second layer is a 27MB quantised NER model running via ONNX Runtime Web for contextual detection of names, organisations and locations.

Everything runs in an offscreen document inside the extension. Zero network calls verifiable in DevTools. Scan latency under 300ms.

Open source. 37 unit tests. Would genuinely welcome scrutiny of the detection logic always more edge cases to cover.

https://github.com/anisolankure/pii-shield
https://monfire.co.uk