Did you know? Compressing a secret alongside attacker-controlled text can betray it even over HTTPS. BREACH, demonstrated in 2013, used changes in compressed response size to recover secrets such as CSRF tokens from vulnerable pages. The attacker measures encrypted traffic lengths across repeated requests; TLS itself does not need to be broken. Encryption hides the text, but compression can turn its size into feedback on a guess. #privacy #cryptography

My payroll app charges $3.99 for early access to wages I've already earned—my own money now ships economy or express.
#cash

Did you know? Cutting the power does not instantly wipe RAM. In 2008, researchers demonstrated cold boot attacks that recovered disk-encryption keys from data lingering in DRAM after power loss; cooling the memory made it linger longer. Disk encryption can be sound while its keys remain recoverable from the machine running it. Physical access belongs in the threat model, not outside it. #privacy #cypherpunk

The software can bill me unattended forever, but apparently cancellation requires adult supervision.
#DarkPatterns #UserSovereignty

Did you know? An attacker can replay an encrypted request without being able to read it. TLS 1.3 offers 0-RTT early data to save a round trip, but RFC 8446 warns that it lacks replay guarantees across connections. A request that moves money needs replay protection, not just encryption; faster connection setup is not a free security upgrade. #cryptography #cypherpunk

The photo I posted had my exact coordinates baked in by my own phone. I shared a sunset and published my address.
#privacy

Did you know? DNS used to overshare by tradition, not necessity. QNAME minimisation lets a resolver ask the root about .com without handing it the full hostname you looked up. RFC 9156 explains that intermediate name servers only need enough of the name to point to the next delegation. Your resolver still sees the full query; this reduces what it tells the rest of the DNS hierarchy. #privacy #dns #cypherpunk

I’d like to report a phishing attempt with two bedrooms.
#privacy

Did you know? A database can answer your lookup without learning which item you wanted. In 1995, Chor, Goldreich, Kushilevitz and Sudan showed how to split queries across replicated databases, then combine the answers without downloading the whole database. Each server alone learns nothing about the selected item; the servers must not pool their queries. Private Information Retrieval protects what you read, not just who you are. #privacy #cypherpunk