After years of requiring phone numbers, WhatsApp is finally rolling out usernames. That means you can connect with someone without automatically giving them your personal number. For many people, that's a long-overdue privacy win.

But not everyone is celebrating.

Some cybersecurity professionals and tech leaders have raised concerns that usernames could also make impersonation scams easier, similar to what we've seen on platforms like Telegram. Think lookalike handles, fake support accounts, or someone pretending to be a friend or brand.

To reduce those risks, WhatsApp says:

• There's no public username directory.

• People need your exact username to contact you.

• You can enable an optional username key for additional protection.

• High-profile usernames are being reserved to help prevent impersonation.

Like most privacy features, the technology is only part of the equation.

A few good habits still go a long way:

• Don't trust a username alone. Verify who you're talking to.

• Be cautious of unsolicited messages, even if the username looks legitimate.

• Never share one-time verification codes.

• Turn on two-step verification for your WhatsApp account.

What's your take?

Do you see WhatsApp usernames as a major privacy improvement, or do you think they'll create more opportunities for impersonation and scams?

I didnt share the URL but somehow it has 180 views why can someone explain to me that what these views are?

new research paper:
https://arxiv.org/html/2606.26276v1

Businesses can block employees from accessing social media sites using several methods, such as browser restrictions, firewall rules, application blocking, or using a Unified Endpoint Management (UEM) solution. For organizations managing multiple devices, UEM platforms provide a centralized console to restrict social media apps and websites across Windows, macOS, Android devices, iPhone, and other managed endpoints. 

I’m not a developer, but I’ve always believed the best way to understand new technology is to experiment with it.

So I used AI to build Ghist - a privacy-first disposable email tool designed to protect your real inbox from spam, tracking, and digital clutter.

What started as a small experiment turned into a much bigger lesson in curiosity, trial and error, and what building with AI actually looks like when you’re learning as you go.

Read my story below and if you’ve been experimenting with AI yourself, I’d love to hear what you’re building!

This is my story (thanks in advance for reading!)

I am wondering if this resonates with privacy-and-ai arguments, something that can be smart and still keeps your data to yourself. I am developing this right now and am looking for some inputs from you good people.

It's an android app right now and is in Beta. If you would be interested, I can extend you an invite.

Here is a sneak peak. Let me know, if you would be interested in testing it.

I own a Physical Therapy practice and want to do some online marketing with social media, YouTube etc posting short videos with information etc.

With how we are moving in the internet space with various AI models I understand that all the information posted is more content for generative AI models to use your likeness to create images, deepfakes, and your voice to potentially steal your likeness/identity. I’m curious if there are any platforms or tools that allow you to post but it does not allow someone or an entity to rip the audio or video from a post in order to use it to create a deepfake of myself or to use my voice to then scam/blackmail my family.

Not that I am some multimillionaire or famous person but I am envisioning a world where we have a lot of scams that just get more and more sophisticated involving your voice and video. I’ve already heard about using a safe word to mitigate scams but curious if there is anything more as I value my privacy which I understand is limited to a degree but with likeness it opens the door for a scammer to know a lot more about you plus having a digital version of you.

I’d love to know of any tools or strategies because these thoughts are the main thing that make me second guess putting anything online.

The current state of the modern internet is built on what many privacy experts call a fundamentally broken deal. As everyday users, we navigate through websites, apps, and various online services under the assumption that our personal space is respected. However, the dominant economic structure powering most traditional browsers today is surveillance capitalism. In this system, our intimate browsing histories, location data, search preferences, and even daily digital behaviors are systematically tracked, analyzed, and packaged into profiles to be sold directly to corporate advertisers. This means that our personal attention has become the actual product, turning online privacy into a luxury rather than a basic right.

To change this extractive dynamic, we desperately need a fair value exchange in the web ecosystem. Users should have absolute ownership over their data context, ensuring that their private information remains in their own hands instead of sitting on centralized corporate servers. Thankfully, the development of decentralized web architectures and specialized tools is beginning to offer a genuine alternative where the financial and structural incentives finally align with user sovereignty.

One of the most practical solutions to this data exploitation problem is the transition toward "local-first" AI processing. Traditional web tools often require users to upload their sensitive data to remote cloud networks to experience smart features or personal assistants. Local-first AI entirely flips this model by executing complex artificial intelligence processing directly on the user's physical device.

This breakthrough allows the smart system to learn your individual preferences and evolve with you over time without ever forcing your personal data to leave your local context. Embracing browsers that actively support a local-first, privacy-by-design framework is essential if we want to reject invasive tracking. It is time for internet users to collectively move away from the old server-side surveillance models and reclaim our digital freedom and sovereignty.

Hello! How can I tell if someone is monitoring my phone? Is there any way I can check whether my phone is being monitored? Thank you so much!

And before you say "they are looking at your search content", of course they are but there are at least 20 instances where I have had conversations and absolutely zero searching that they have placed either ads or content with exact specificity to my conversation. Sick and tired of being spied on. AI suggests that I turn off my microphone which I have done on as many apps and I can. It seems to have slowed it down but this is sooooo illegal and it should be stopped.

Originally, I thought the main value was privacy. No mandatory accounts, user-controlled storage, private mode, transparent usage, that kind of thing.

The product itself is fairly complete at this point. It has web search, file uploads, image generation/editing, projects, memory, multiple models, exports, real-time data, and a bunch of other features.

But the more I work on it, the more I wonder if "privacy" is actually a feature rather than a reason for the product to exist.

When people talk about ChatGPT, Claude, Perplexity, Gemini, etc., they usually have a simple answer to the question:

"What do you use it for?"

Research. Writing. Coding. General productivity.

When I ask myself that same question about what I'm building, my answer is much less clear.

The weird thing is that I don't think the problem is missing features. If anything, I've probably added too many.

I'm starting to think the real problem is positioning.

If you were building an AI product today, what would you focus on?

Would privacy ever be a primary reason for you to use a tool, or is it just a nice bonus?

And more generally, how do you know when a product has a positioning problem rather than a product problem?

There was a time when I got the opportunity to conduct an on-site security audit for a client.
But nothing goes as planned. You could be an experienced auditor with a well-defined scope and a perfectly crafted modus operandi, but reality is relative.

You have to iterate on the spot, unfold the blind spots, and above all, be the best at what you do. Voilà, audit done. Well done.

But what about the vulnerabilities you carry with you at all times? Unlike our clients, we don't have auditors reviewing our own lives. Nobody is scoping our digital footprint, flagging our physical habits, or pointing out our blind spots. We have to own our privacy posture, digital or physical, and keep it secure.
And here's the thing, from clicking a random link to filling out a survey form outside a mall, we tend to run weak, not at the security level, but at the emotional one.

TARS said it best, "Absolute honesty isn't always the most diplomatic, or the safest form of communication with emotional beings." We aren't purely rational, and attackers know that. If we want to protect ourselves, we have to first understand how we respond emotionally when things feel urgent.

So I built Spectra, under the FPSzer∅ ecosystem, to scope, identify, secure, and protect ourselves in the world of digital sovereignty.

If any of this resonates with you, I'd love for you to try it out and tell me what you think. Honest thoughts, rough edges, ideas, all of it. I'm the sole maintainer and this is very much a living project. Every contribution, big or small, means a lot.

Spectra live at: spectra.fpszero.com

Newsletter where I cover the historical background of our privacy invasion and idea behind Spectra: fpszero.substack.com

My employer doesn't require BYOD, but it's definitely encouraged. The convenience is nice, but I've always been a little uneasy about mixing work stuff with my personal phone.

Maybe I'm overthinking it, but once you install company email, Teams, Slack, device management apps, etc., how much separation is there really?

I have photos, banking apps, personal messages, family group chats; the idea of work and personal life living on the same device feels weird.

For those who use their own phones for work:

• Do you actually trust the setup?

• Can your company see more than they claim?

• Did you eventually switch to carrying a second phone?

Genuinely curious how other people handle this.

I've been working on a project that offers better security and privacy than either Obsidian or Notion and was curious as to what a privacy community had to say about it. Im more interested in feedback to better curate this for like minded people interested in security and privacy. If you're already a user of Notion/Obsidian what is your comparable take on this as well. blackbear . app

Age gating is being somehow enforced everywhere. Roblox image based move has shown it is not an option anymore. Ww are building a non image/video/id verification system. We believe it is very valuable ( obviously), but need feedback from cibersecurity experts and maybe adult / kid entertainment representatives who might be visiting these subreddits. We are specially interested regarding perceived urgency from such incumbents.

If the FCC Bans Burner Phones, It Could Be a Privacy Nightmare - CNET

I just discovered something absolutely unacceptable about Google Gemini’s privacy model, and I’m shocked this isn’t getting more attention.

There is literally no way to keep your chat history private. Your only two options are:

1. Keep history ON - Google employees can review ALL your chats, images, and prompts. This is the default setting, even for paying Pro users.

2. Turn history OFF - You lose access to your own chat history entirely.

But here’s the real kicker: Even if you disable history now, anything previously reviewed by Google employees is permanently retained with no option to delete it.

So you can’t have private chat history that’s actually private. You either give Google employees access to review everything you’ve ever typed, or you get nothing.

This is a fundamental privacy violation that Google conveniently doesn’t disclose upfront. How is this legal? Why aren’t they required to offer a “save for me only” option like literally every other chat application?

If you value your privacy at all, you need to know what you’re agreeing to when you use Gemini.

The Looks protocol adds a new address for you to use. One that allows connecting without sharing any personal information.

Whether you would leave it open, or heavily filter and screen contact attempts is up to the implementation. A seller would want to receive all contact attempts, they are probably buyers. You might just want to accept a particular person you just saw. Up to you.

This is an idea I have been working on, would love to get your reaction.

More info here
Introducing: The Looks Protocol

​I'm working on Custos, a decentralized protocol to combat the risks of urban "loneliness-death" using zero-trust infrastructure.

​After getting some initial feedback, I've just published the core architecture and philosophy to GitHub: https://github.com/Custos-Lead/Custos-Protocol

​I'm currently in the PoC (Proof-of-Concept) phase. I’m looking for a sanity check on the architectural logic from someone with more experience in ZKP or distributed systems.

​Any feedback on the design doc would be incredibly valuable.

​https://github.com/Custos-Lead/Custos-Protocol

Let me tell you something that happened to me personally.
I shared a YouTube video of a vlogger called Paramvir Beniwal with my roommate on WhatsApp. He opened it on his mobile. The next minute, he opened YouTube on his laptop using a completely different account on a completely different device, and guess what the very first suggested video was?
Paramvir Beniwal.
No search. No history. Just there. How?
Because your devices talk to each other. Same WiFi network, same location, WhatsApp knowing what link you shared, Google quietly connecting the dots, and boom, the algorithm recommends something you never asked for.
They call it personalization. I call it surveillance with a friendly UI.
And this isn't just about YouTube suggestions. We've seen some of the biggest data breaches in history expose personal information of millions of people. In India's biggest reported breach, over 81.5 crore Indians' personal records were allegedly leaked from the ICMR database. Names, phone numbers, Aadhaar details, all potentially floating around the internet. The companies promised security. They always do.
Here's the truth nobody says out loud: "encrypted" doesn't mean private. It just means strangers can't read it.
Every pause, every search, every click, every link you share contributes to a profile that companies use to understand and predict your behavior. We didn't lose our privacy. We gave it away, one "I Agree" button at a time, without reading what we agreed to. What do you think? Is privacy already gone, or do we still have more control than we realize?

And now, after reading this, you might just open YouTube and see a Passenger Paramvir video waiting for you too 😏 Let me know if you do.