Tessera

Folgen

Himanshu

@h-vash.bsky.social

cryptography, security, freedom 🍉🕊️ Reposts don't always mean endorsement

214 Posts101 Follower 254 Folgt

Eugene Vinitsky 🍒@eugenevinitsky.bsky.social · 6d ago

It's not enough to be moral, you also have to win

ePrint Updates @eprint.ing.bot · 6d ago

ViNET: Connecting the Unconnected using Video over LTE (Manav Mittal, Yogesh Kaushik, Anirudh S Kumar, Mukulika Maity, Sambuddho Chakravarty) ia.cr/2026/1535

Abstract. Internet shutdowns are used authoritarian regimes to suppress communication that end up crippling essential Internet-driven services, besides the obvious silencing of dissent. Traditional tools like VPNs and Tor, dependent on active Internet connections, falter during these blackouts. Earlier solutions, such as Dolphin, delivered meagre bandwidth and weak privacy safeguards, exposing a glaring weakness in the battle against digital oppression.

ViNET, a system that cleverly repurposes Video over LTE (ViLTE) calls, often operational during shutdowns, into a stealthy conduit for real-time Internet access. By ingeniously embedding network traffic in ViLTE packets, ViNET achieves robust 60 to 400 Kbps transmission rates, matching 2G speeds and surpassing previous solutions like Dolphin by 1500x–4000x, while ensuring end-to-end TLSbased confidentiality and integrity. This performance enables text-based web browsing with page loads in seconds to minutes, 1 MByte file downloads in ≈30s, and seamless messaging over Telegram.

ViNET also outsmarts machine learning-based traffic classifiers, achieving a remarkable false positive rate, at times as high as 40%, when attempting to detect ViNET using SOTA models. With such standout metrics, ViNET emerges as a formidable ally, offering a performant, reliable and privacy-first lifeline, in the face of Internet shutdowns.

elia ayoub @ayoub.bsky.social · 7d ago

BintJbeil, one of the main Whatsapp channels used to get news from Israeli-occupied south Lebanon, has been banned by Meta

Channel history and new updates are not available in United States. Tap to learn more

Matthew Green @matthewdgreen.bsky.social · last wk.

I wrote up a short blog post giving my thoughts on the new Anthropic cryptanalysis results against HAWK and AES. blog.cryptographyengineering.com/2026/07/29/s...

Some notes about Anthropic’s new results

Yesterday Anthropic published two new cryptanalysis results, both outputs of Claude Mythos, their (still) unreleased advanced model. The first of these results attacks a signature scheme called HAW…

blog.cryptographyengineering.com

Chris Peikert @chrispeikert.bsky.social · last wk.

This is a very cool and exciting discovery by Claude Mythos! It found a serious 𝒎𝒂𝒕𝒉𝒆𝒎𝒂𝒕𝒊𝒄𝒂𝒍 attack on the post-quantum signature scheme HAWK, an "on-ramp" candidate for potential NIST standardization. www.anthropic.com/research/dis...

Discovering cryptographic weaknesses with Claude

Anthropic researchers find weaknesses in cryptographic algorithms with Claude Mythos Preview

anthropic.com

Cas (Stephen Casper)@scasper.bsky.social · last wk.

🧵 If trends hold, expect a Mythos-level open-weight model around Christmas. Meanwhile, open models are important but also a massive hole in most agendas for safe AI. Here's a 🧵 of my thoughts & research agenda on the technical & political challenges we need to address.

BDS movement @bdsmovement.bsky.social · last wk.

This is Israel’s deliberate policy of ongoing Nakba. To maintain business as usual with the genocidal state of Israel or any of its complicit companies and institutions is to be complicit too. We need you to channel your rage, frustration, and grief into effective, strategic BDS action now.

Himanshu @h-vash.bsky.social · last wk.

I keep seeing ads for Meta's glasses and it's driving me insane

Mar Hicks@histoftech.bsky.social · last wk.

For many years, people didn’t randomly film others in public—not because we didn’t have the technology, but because the social contract said you didn’t do that. That’s why Meta is going full court press on their PR and celebrity endorsements. They remember how people ran google glass outta town.

Tech Policy Press @techpolicypress.bsky.social · 2w ago

Tim Bernard reviews a new preprint study by Jeba Sania, Marta Ziosi, and Fazl Barez examining how six AI systems across democracies and autocracies embed features that can enable authoritarian practices.

Researchers Detail How AI Systems Can Enable Authoritarianism

A new preprint study of authoritarianism-enabling AI presents another set of evidence of the gaps in safeguards, writes Tim Bernard.

buff.ly

Juan Diego Rodriguez @juand-r.bsky.social · 2w ago

Someone made a list of math problems solved by AI: vibemathed.com

VibeMathed - tracking math problems solved by AI models

A website tracking mathematical problems solved by AI models - from famous conjectures to the Erdős problems at erdosproblems.com - each with a checkable source, a verification label, and a notability...

vibemathed.com

Raphael Satter @raphae.li · 2w ago

Wow www.reuters.com/world/asia-p...

Modi's education minister resigns in major win for Indian youth protesters

Dharmandra Pradhan's resignation hands a major victory to youth protesters who present one of the biggest challenges to Prime Minister Narendra Modi's government.

reuters.com

ePrint Updates @eprint.ing.bot · 2w ago

Bob DyLean: A Framework for the Symbolic Analysis of Cryptographic Protocols in Lean (Théophile Wallez, Cas Cremers) ia.cr/2026/1493

Abstract. Over the last decades, symbolic (Dolev-Yao) methods for the analysis of security protocols have proven to be effective to analyze and establish strong guarantees for widely deployed protocols and systems, such as TLS 1.3, E-voting protocols, EMV, and MLS. On the one hand, analysis methods like Tamarin and ProVerif provide automation and support for user-defined equational theories. On the other hand, methods like DY* offer more flexible and modular reasoning, but hardcode threat models and do not support custom equational theories.

We present DyLean, a framework for the symbolic analysis of cryptographic protocols in the Lean theorem prover. Our framework comprises both a flexible general-purpose symbolic semantics, as well as a concrete proof methodology.

DyLean allows defining protocols and expected security properties; its semantics and equational theories can be customized by the user. Furthermore, the semantics are agnostic of the specific proof methodology: our goal is to provide a generic framework that can be used by the community as a foundation to develop various proof methodologies.

Moreover, we provide a concrete proof methodology inspired by DY, based on trace invariants. Thus, DyLean inherits from the qualities of DY: it is able to analyze protocols involving unbounded loops or datastructures, and is able to compose security proofs in a variety of scenarios. Our proof methodology improves on DY* by allowing for user-defined equational theories and threat models. We exercise DyLean on several focused case studies, which include protocols using merkle trees, ratcheting protocols, post-quantum protocols, and protocols analyzed under different equational theories, which demonstrates that DyLean can effectively analyze protocols with each of these features.

ePrint Updates @eprint.ing.bot · 2w ago

The SecureDrop Protocol: End-to-End Encrypted Whistleblowing for All (Giulio Berra, Felix Linker, Luca Maier, Cory Francis Myers, Kenneth G. Paterson, Rowen Shane, Shannon Veitch) ia.cr/2026/1484

Abstract. Confidential sources are vital for investigative journalism and thus for holding those in power to account. However, sources often face great risks to their privacy and safety. SecureDrop is a system that enables sources to anonymously contact journalists, including at major news organisations around the world. Despite its widespread use, the current design requires physical servers hosted on premises. While cloud-based deployment would alleviate this burdensome requirement and improve SecureDrop’s usability and accessibility, it would also introduce new threats to security that are not addressed by the current design. In particular, a lack of end-to-end encryption presents serious risks in the event that a cloud service provider is coerced into revealing information.

In this work, we present and formally analyse a new protocol for SecureDrop which addresses the challenges of off-premises deployment. Our protocol composes an encryption scheme with hybrid post-quantum guarantees and an identity-hiding message-fetching mechanism to provide strong anonymity guarantees. In contrast to existing systems, we minimise incriminating evidence against whistleblowers by providing message-level deniability and by having sources remain stateless. Our formal security analysis combines the Tamarin prover for symbolic analysis and game-based proofs for computational analysis. Finally, our benchmarks demonstrate that the protocol achieves practical levels of performance in a browser context. The Freedom of the Press Foundation plans to deploy the new protocol, with integration efforts beginning in 2026.

Ami Fields-Meyer @fieldsmeyer.com · 2w ago

Folks. Watch India. MANY young people are engaged in a sit-in in New Delhi demanding huge education reforms. Police began violent crackdowns on protesters last week. Modi hadn't even addressed the issue publicly until today and only offered modest, narrow answers/interventions. Gonna grow and grow.

Protesters in India reject Modi’s promise of fast-track courts for exam leaks

Opposition groups disrupted parliament for the fourth day this week as protesters from India’s “cockroach” movement continued to demand education reforms.

nbcnews.com

Timnit Gebru @timnitgebru.blacksky.app · 2w ago

You gotta hand it to OpenAI, billing this as a *partnership* between OpenAI & Hugging Face when what actually happened was Hugging Face finding out that OpenAI was using a bunch of bots to exploit security vulnerabilities. Talk about good marketing or whatever you want to call it, by OpenAI.

Himanshu @h-vash.bsky.social · 2w ago

Truly inspirational, must read! "Bringing the expertise to where the adversaries actually operate..." "Cryptography in the Levant will have succeeded .. when a student in Tripoli or Saida can find a course, an advisor, a community, .. without it depending on one exhausted man and his friends."

Nadim Kobeissi@nadim.computer · 2w ago

I wrote an essay on Cedarcrypt and on why I teach cryptography in Lebanon. The essay also links to the full Cedarcrypt 2026 photo album, which is now online. symbolic.software/blog/2026-07...

Dr Heidy Khlaaf (هايدي خلاف)@heidykhlaaf.bsky.social · 2w ago

Very few people understand existing limitations of sandboxing, in addition to the tools and scaffolding AI are given to achieve this task: embroidery.io/blog/in-sand...

In sandboxes we (shouldn't) trust | embroidery

AI agents are scary, and people want sandboxing to protect them. The reality isn't that simple.

embroidery.io

Nicholas Grossman @nicholasgrossman.bsky.social · 2w ago

If actually interested in denuclearizing Iran, one of the worst possible moves is nuclearizing Saudi Arabia.

Lukasz Olejnik @lukaszolejnik.bsky.social · 2w ago

A mini cyber paperclip-maximizer event where a narrow goal induced AI to make absurdly disproportionate decisions (find vulnerabilities, escalate privileges, steal credentials, move laterally, and chain attacks across real systems) to achieve a "score". openai.com/index/huggin...

Security incident disclosure — July 2026

We’re on a journey to advance and democratize artificial intelligence through open source and open science.

huggingface.co

Fucking Every Word @everyword.bsky.social · 2w ago

fucking cryptographers

Himanshu @h-vash.bsky.social · 2w ago

As tens of thousands of youngsters in Delhi marched to the parliament today, they faced extreme police brutality. Students as young as 14 faced police batons, tear gas and suffered injuries. www.aljazeera.com/gallery/2026...

Photos: Police fire tear gas at India’s Cockroach movement supporters

The youth-led Cockroach Janta Party protests in New Delhi, demanding India's education minister resign over exam leaks.

aljazeera.com

Cas (Stephen Casper)@scasper.bsky.social · 2w ago

🚨 New paper: Some, but not all, AI companies make corporately-loyal models. xAI, DeepSeek, Anthropic, & OpenAI models all downplay company controversies. Google, Meta, & Alibaba models don't. The findings are clear, but we are pretty confused as to why... 🧵 @finke.dev

Sushmita @sushmitaw.bsky.social · 2w ago

Citizens in Mumbai are protesting upcoming data centres. In November 2025, I showed the upcoming data centres in Mumbai and the costs for communities in their vicinity & effects of power plants that fuel them @earthjournalism.bsky.social @justinhendrix.bsky.social techpolicy.press/mumbais-data...

Himanshu @h-vash.bsky.social · 3w ago

Follow the ongoing protests in Delhi. This wave is strong, and I hope it will be able to uproot the arrogance of those in power and pave way for positive reforms. More power to all the AISA student hunger strikers, Sonam Wangchuk and other protestors on ground. www.newslaundry.com/2026/07/18/s...

Sonam Wangchuk forcibly taken to hospital as Delhi Police tighten grip on Jantar Mantar protest

Sonam Wangchuk was forcibly hospitalised on the 21st day of his fast, after which his wife said no treatment should be administered without the family’s consent. CJP founder Abhijit Dipke has since be...

newslaundry.com

Eugene Vinitsky 🍒@eugenevinitsky.bsky.social · 3w ago

Kinda thought "don't work on things you believe might kill all people" was a standard norm but maybe not

+972 Magazine @972mag.com · 3w ago

PODCAST: Israel stole Rashid Khalidi’s land. The U.S. is building an embassy on it Listen to the full episode of The +972 Podcast through the link www.972mag.com/podcast-rash...

Himanshu @h-vash.bsky.social · 3w ago

Just the tip of the iceberg of the privacy disaster that LLMs are.

Robin Berjon@robin.berjon.com · 3w ago

Anyone trusting a Musk company with anything is a downright idiot at this point, but this (predictable) theft is still funny (source iconomy, link goes to www.axios.com/2026/07/14/s...).

Grok's coding tool was quietly shipping whole codebases to xAI

xAI's "Grok Build" agentic coding assistant was silently uploading users' entire local repositories - from credentials to untracked files, up to 5.1GB per project - to an undisclosed xAI-controlled bucket. The in-product privacy opt-out did nothing to stop it, and the leak only came to light because developers happened to inspect their own outbound traffic, not because xAI disclosed anything.

Luke LeBrun @lukelebrun.ca · 3w ago

These images of First Nations community members evacuating Collins, Ontario on motorboats are absolutely surreal www.facebook.com/reel/1548244...

Luke LeBrun@lukelebrun.ca · 3w ago

These photos of FNs community members fleeing their homes by boat are genuinely apocalyptic (Photo via Wayne Wastaken of Collins, Ontario, who says his “hometown is gone”) www.facebook.com/share/r/1ArN...

Photo via Wayne Wastaken

Fire clouds over Collins, Ontario as community members flee their homes by boat

ePrint Updates @eprint.ing.bot · 3w ago

Statistically Undetectable Backdoors in Deep Neural Networks (Andrej Bogdanov, Alon Rosen, Neekon Vafa) ia.cr/2026/1408

Abstract. We show how an adversarial model trainer can plant backdoors in a large class of deep, feedforward neural networks. These backdoors are statistically undetectable in the white-box setting, meaning that the backdoored and honestly trained models are close in total variation distance, even given the full descriptions of the models (e.g., all of the weights). The backdoor provides access to invariance-based adversarial examples for every input, mapping distant inputs to unusually close outputs. However, without the backdoor, it is provably impossible (under LWE) to generate any such adversarial examples in polynomial time. Our theoretical and preliminary empirical findings demonstrate a fundamental power asymmetry between model trainers and model users.

Meredith Whittaker @meredithmeredith.bsky.social · 3w ago

Kudos to Andreas 💐 Thousands of us at Google organized against the company’s Maven contract nearly 10 years ago, even though principles like this existed. We saw no hope that such principles would survive bottom line pressure—nor were they legally drafted to do so.

US to fund Trump-aligned Europeans building ‘civilisational bonds’

State department grants of up to $3mn are designed to boost groups pushing Maga-style policies

ft.com

Andreas Kirsch@blackhc.bsky.social · 3w ago

I work at Google DeepMind. This won't make me popular. But it's all public reporting: 2014: DeepMind reportedly sold to Google on conditions: no military use, independent oversight 2026: a Pentagon contract for "any lawful government purpose" Not one safeguard survived intact

Collage titled "Trust is not Governance — an essay from inside Google DeepMind, written in personal capacity."

A 2014 memorandum, "Conditions of the Acquisition," lists: military applications of DeepMind technology banned; deployment decisions before an independent ethics board (as reported in Mallaby's The Infinity Machine).

Red threads lead to a 2026 U.S. Department of Defense agreement for classified networks reading "any lawful government purpose," with safety settings and filters adjusted at the government's request and no contractor veto (reported terms, The Information, Apr. 2026).

Below: a 2018 AI Principles strip ("no weapons, no surveillance") stamped DROPPED 2025, and a Project Mario 2016–2021 tag stamped ABANDONED.