via Schneier on Security

Did recent events leave you wondering “how could LLMs be useful for spying on citizens”? Here’s just one concrete example.

We show that from a handful of comments, LLMs can infer where you live, what you do, and your interests – then search for you on the web. In our new research, we show that this is not only possible but increasingly practical.

Check out the full paper for details.

Buddy Guy brought the house down at Tiny Desk, with a feature from rising-superstar Miles Caton.

Once again, thank you Sinners.

When you overload a credential used for authentication by also using it for encryption, the ‘blast radius’ for losing that credential becomes immeasurably larger.

Password managers are an important area with surprisingly little formal analysis and this work emphasized the importance of fixing that.

To be presented at Real World Crypto 2026 and published at USENIX Security 2026.

Full paper can be found here: https://eprint.iacr.org/2026/058.

Bitwarden’s blog post on the subject is here: https://bitwarden.com/blog/security-through-transparency-eth-zurich-audits-bitwarden-cryptography/¹.

via Bas Westerbaan

A curated and crowdsourced list of ~*fancy*~ cryptography protocols, currently deployed at scale.

Some rabbit holes I’m falling down:

• Chrome’s compromised password checks using PSI
• Proton’s user authentication
• Whatsapp’s encrypted backups plus the meta whitepaper