cloak and dagger 🗡️ tech. clandestine comms + cryptography. Founder of Katzenpost, a fully post-quantum mixnet. https://xitter.gq/t.co/Wsb9AMq5pQ
Spain
Joined January 2009
- Tweets4.6K
- Following2K
- Followers1.4K
- Likes2.5K
David Stainton priv/acc retweeted
A CVE (Common Vulnerabilities and Exposures) is a publicly disclosed security flaw.
They increased following a slight upward slope all the way to early 2024, when there was a sudden small increase... then starting in 2026, we went full exponential.
In most instances, the vulnerabilities were pre-existing, so much of the increase is just our better ability to find the faults.
This is of historical importance. We have never witnessed anything of the sort.
David Stainton priv/acc retweeted
Small announcement: ✅ formal-git
As an experiment, over the last 2 months we've modelled ~30% of Git in Lean 4, making heavy use of coding agents, and proved >8000 theorems of varying usefulness about the implementation.
In the process of doing this we've uncovered >100 potential defects in Git v2.55, at least two of which may constitute security vulnerabilities. We've also built a DRT (differential random testing) harness and the biggest corpus of relevant pinned differential test cases for Git implementations with >10k unique tests at the moment.
We've used the test cases to test our own small internal implementation of Git in TypeScript. The next step will be to differentially test all notable public Git implementations against this corpus of tests to help improve their correctness and security 🫡 We'll be reaching out to library maintainers in due course.
If you have a Git implementation you'd like us to help you test, please reach out and let me know. We'll open-source all this eventually, after potential security issues that were uncovered are responsibly disclosed and fixed.
ALT Infographic: Reads: formal-git, Git, rebuilt in Lean 4, with machine-checked proofs
David Stainton priv/acc retweeted
Announcing hashsma.sh! 𝟘 𝟙 ❒ 🔨
Strengthen cryptography with AI.
Cryptography—both current and post-quantum cryptography—depends on hashes. SHA-256? SHA-3? BLAKE3? Nobody knows if they are secure. We're going to find out!
Come help accelerate scientific research!
HashSmash is an open science-acceleration project in collaboration with @yukonresearch, @eigenlabs, @projecteleven, and @ShieldedLabs.
David Stainton priv/acc retweeted
Can we get the IETF TLS WG chairs to help out with the U.S. elections? Allow votes only from pre-existing landowners plus the list of people who the chairs declare have demonstrated enough expertise to vote? Also, make sure to hide that list: web.archive.org/web/20260719…
David Stainton priv/acc retweeted
SimpleX Chat can't and won't scan private chats, ever. It's not just a promise, it's a technical impossibility.
314 MEPs just voted AGAINST mass surveillance "Chat Control."
Only 276 voted for it. Yet it still passed.
More Members voted to kill the mass surveillance bill than to keep it and it became law anyway.
This is the EU’s version of “democracy” when it comes to destroying privacy civil liberties.
reclaimthenet.org/eu-brings-…
David Stainton priv/acc retweeted
Yesterday was a sad day for the privacy of citizens in the European Union given the extension of #ChatControl 1.0, allowing for voluntary scanning of private communications.
In light of yesterday's vote, we wanted to remind you that:
Chat Control 1.0 is different from Chat Control 2.0 in that providers (like us at Tuta) are not forced to backdoor their end-to-end encryption for surveillance.
At Tuta, if Chat Control 2.0 is passed we have two options: to move out of the EU or sue and fight it. As our CEO, Matthias Pfau has stated, we would sue and fight for people's privacy. Because for us, undermining end-to-end encryption is not an option.
We will continue to say no to #ChatControl and fight for everyone's right to privacy. ✊🏻❤️🔒
Find out more about Voluntary Chat Control here 👉 tuta.com/blog/voluntary-scan…
David Stainton priv/acc retweeted
The EU Parliament REJECTED Chat Control, but now they are forcing us to vote it AGAIN to revive it. What kind of democracy is this if we're forced to vote on the same issue over and over until they get the result they want?
My colleague @MarketkaG explained the situation very well in plenary👇🏻
David Stainton priv/acc retweeted
The EU Parliament rejected mass scanning of private messages in March.
Yesterday, it approved an urgent procedure to revive the measure, setting up a decisive vote on Thursday, the last sitting day before summer recess.
At second reading, the text passes automatically unless 361 MEPs vote against it, and some MEPs have already left for the Summer break...
reclaimthenet.org/eu-parliam…
David Stainton priv/acc retweeted
FWIW, I actually do support better regulations and tools to protect children, but that control should rest with the parents and caregivers.
For example, being able to buy a device and set an age signal is actually a great idea, but I as a parent should choose to set that setting. The government shouldn't be forcing me to first prove my age to the device.
The CA regulations got this completely backwards. They should be mandating availability of stronger parental controls and developing open source software to that effect. Instead, they are mandating a bunch of third parties collect and verify identity information about you so it can be used against you later.
That information is valuable and will be used to train AI, track, charge you different prices, and classify you for extra screening at security checkpoints. This is all clearly designed both to enable corporate data vampirism and government overreach.
David Stainton priv/acc retweeted
fightchatcontrol.eu/download…
Call them:
europarl.europa.eu/news/en/c…
europarl.europa.eu/meps/en/h…
Lazier contact tool:
fightchatcontrol.eu/#contact…
David Stainton priv/acc retweeted
EU Parliament is again voting on chat control, but a broader version this time that makes scanning content on your local device mandatory.
This is part of the broader effort worldwide to enact what I call the #stasinet, using the excuse of protecting children to enable ID checks to record everywhere you go online and the ability to open and scan your personal messages (i.e., your personal papers and effects or in US terms violate our 4th amendment protections).
If you are in the EU, I think your best bet is to do what we do and call your relevant representatives offices to register your opposition. Links to do that follow in the next message.
David Stainton priv/acc retweeted
Unhappy with NSA's SIGINT Enabling Project sabotaging cryptographic standards? This week you can take action to register an objection with IETF regarding an NSA-funded project to standardize ietf-tls-mlkem, a weakened version of ietf-tls-ecdhe-mlkem: nsa.2026.action.cr.yp.to/
David Stainton priv/acc retweeted
If you're able, please check out nsa.2026.action.cr.yp.to/ and write to the mailing list your objection to weakening the proposed standards from IETF TLS working group.
David Stainton priv/acc retweeted
Check out this extremely valuable interview by @hashbreaker --
youtu.be/qPhoJQtvgUo?t=799
I could not agree more on transitioning into a post quantum world starting with hybrid approaches using both classical encryption paired with quantum resistant encryption algorithms.
David Stainton priv/acc retweeted
The EU's Chat Control fight just reignited, and critics warn the worst case is back on the table: mass scanning of private messages, detection orders without a judicial warrant, and the end of anonymous communication through forced age verification.
Former MEP Patrick Breyer is warning of what he calls a "double attack" on encrypted messaging: EU government envoys met Friday to try to revive lapsed rules allowing "voluntary" scanning of private chats, and Monday June 29 brings the final trilogue on the permanent Child Sexual Abuse Regulation (Chat Control 2.0).
Parliament rejected extending the old scanning rules in March and they expired in April. Breyer claims EP President Roberta Metsola is maneuvering to force another vote, which Politico has also reported. Backers, including the Commission, call it child protection.
Civil society has relaunched fightchatcontrol.eu to push MEPs before Monday.
David Stainton priv/acc retweeted
Registration is open for our next Security in Times of Surveillance event taking place 26 June at @TUe_MCS eipsi.win.tue.nl/surveillanc…
Speakers include Martin Albrecht, Chloe Berthelemy, Rikke Bjerg Jensen, Thomas Lohninger, Bjoern Ruytenbert, and Carmela Troncoso
David Stainton priv/acc retweeted
GrapheneOS is a non-profit open source project and remaining that way. We aren't paying for any marketing and it's not becoming a business. Linus chose to review GrapheneOS based on using it as a daily driver for 30 days. How does this fairly positive review make it compromised?
