GoKawiil
Tech News
Organizations are deploying new encryption standards designed to withstand future quantum computers, which are expected to eventually break today's cryptographic systems. Separately, recent advances in AI's mathematical problem-solving abilities have raised concerns that AI systems, not quantum machines, could be the first to break current encryption methods.
Apple announced it will begin monitoring iCloud links shared with the "Anyone with the Link" setting, starting in iOS 27.3. The company says it may remove flagged content, disable accounts, block new account creation tied to the same email or phone number, and involve law enforcement for violations of its harmful content policy. Links restricted to specific approved people remain end-to-end encrypted and are not subject to this scanning.
Developer Brisk4t has released ToothPaste V2, an open-source hardware project built on an ESP32-S3 and a cryptographic IC that lets a phone or computer transmit AES-256 encrypted keyboard and mouse commands to any USB-compatible device via Bluetooth Low Energy. The system uses WEB-BLE and requires no drivers, server, or cloud service, and devices must complete a pairing flow before exchanging data. Firmware can be flashed via esptool or similar tools, and the project is available on GitHub.
Security researcher Xusheng Li discovered that Lenovo's ThinkPlus FU100 fingerprint USB drive, marketed as AES-256 encrypted, was actually just an ordinary SD card whose fingerprint sensor merely gated the USB connection rather than encrypting any data. A related flaw in Lenovo's TSD303 SSD showed the device did encrypt data but transmitted the correct password in plain text over USB for verification, making it easy to intercept.
A/SIDE's FAQ outlines how the private photo-sharing and messaging app works: free accounts get 30 days of feed and message history, while Pro Individual ($20/year) and Pro Family ($60/year) plans extend that history. Version 1.6 adds voice captions up to one minute on photos, and the company states that new direct and group chats are end-to-end encrypted, though feed posts and some legacy conversations are not.
A new explainer outlines the different layers of email encryption, noting they guard against distinct threats such as account compromise, network eavesdropping, data breaches and physical theft. It emphasizes that connection-level encryption (TLS) protects data in transit between a device and an email provider, while other threats like phishing or accidental deletion require different safeguards.
404 Media reports that Proton CEO Andy Yen is pressuring engineers to rely more heavily on AI coding tools, based on interviews with eight current and one former employee, internal Slack messages, meeting recordings, and an AI manifesto from the company's CTO. Sources say Yen dismissed a request for extra security testing as 'loser thinking' and told staff that 'perception is more important than truth' regarding communication about Proton's post-quantum encryption rollout.
Stanford researcher Chuyue Sun's AI system completed an engineering verification task in under half a day for less than $500, a job that previously took three experts five months. The work, used to verify part of Signal's encryption code, underpins the public launch of startup &Truth, which Sun joined in August and which has raised $70 million. Rival Harmonic, backed by $295 million and cofounded by Robinhood CEO Vlad Tenev, this week said its AI agent Aristotle can now verify software in C and hardware designs in Verilog, and is testing with firms including Tensordyne and Nvidia's venture arm.
Researchers found that several PDF applications claiming AES-256 encryption actually derive their 32-byte file keys from a tiny or predictable pool of randomness. MuPDF, before version 1.28.5, seeded its random number generator with only the current time in seconds, leaving just 9 bits of effective entropy in the resulting key, while Foxit was found to base its key generation on time-based randomness with similar weaknesses.
Extended Validation (EV) certificates once displayed a green company name in browser address bars to signal verified business identity, but major browsers including Chrome and Firefox have removed that prominent UI, burying certificate details several clicks deep. The piece traces this decline to a mix of factors: users failing to notice or understand the trust indicator, a push by a security-focused nonprofit, and shifts by companies including Stripe, alongside the broader move toward universal encryption via Domain Validation certificates.
Canada's Bill C-22, the Lawful Access Act, has passed the House of Commons and is now before the Senate. The bill would let the Minister of Public Safety compel telecoms and messaging apps to build law-enforcement backdoors, require retention of user metadata for up to a year, and potentially expand cross-border data sharing with U.S. police without Canadian court oversight. The Canadian Civil Liberties Association and Citizen Lab have published an analysis calling for Part 2 of the bill to be withdrawn entirely, and are circulating a petition urging senators to reject it.
1Password has introduced a capability that allows AI agents to authenticate into websites on a user's behalf without directly accessing stored passwords. The company's existing product encrypts user credentials with AES-256 and syncs them across devices via its own servers.