Sylvain

Do you use a cloud-based password manager? So what's your threat model?

Vendors like Bitwarden, Dashlane, LastPass and 1Password offer you "Zero Knowledge Encryption", with statements like: "Not even the team at Bitwarden can read your data (even
if we wanted to)."

We decided to test this… 1/n

Phrack – Darknet Diaries Phrack is legendary. It is the oldest, and arguably the most prestigious, underground hacking magazine in the world. It started in 1985 and is still running today. In this episode we interview the Phr...

The Phrack Staff is on the latest episode of the DarknetDiaries episode!

darknetdiaries.com/episode/170/

Neil Postman quote

Literacy is our greatest weapon to remain robust and defend our humanity in this invasive, modern environment. Here, I recommend 7 books to create more robust humans. And yes, Huxley was right.

perilous.tech/7-books-for-...

Microsoft Gave FBI BitLocker Encryption Keys, Exposing Privacy Flaw The tech giant said providing encryption keys was a standard response to a court order. But companies like Apple and Meta set up their systems so such a privacy violation isn’t possible.

Microsoft is handing over Bitlocker keys to law enforcement. www.forbes.com/sites/thomas...

Submission week for the Cryptographic Application Workshop (CAW), an affiliated event at Eurocrypt'26 in Rome! Please submit your talk proposals on constructive real-world crypto using the following instructions before Jan 23, 2026 AoE. All infos on: caw.cryptanalysis.fun.

Quantum computing for lawyers and anyone who’s not sure what “quantum” means

bfswa.substack.com/p/quantum-co...

Abstract. The paper is currently under embargo, and will be released mid-February 2026.

Zero Knowledge (About) Encryption: A Comparative Security Analysis of Three Cloud-based Password Managers (Matteo Scarlata, Giovanni Torrisi, Matilda Backendal, Kenneth G. Paterson) ia.cr/2026/058

At the gpg.fail talk and omg #39c3

You can just put a \0 in the Hash: header and then newlines and inject text in a cleartext message.

Won’t even blame PGP here. C is unsafe at any speed.

gpg has not fixed it yet.

RWC 2026 accepted papers Real World Crypto Symposium

The accepted talks for Real World Crypto 2026 are now online: rwc.iacr.org/2026/accepte...

Thanks to everyone who submitted, and we look forward to the discussions at the symposium.

The PDF is also available online: archives.phrack.org/issues/72/ph...

More at phrack.org/contact

When will quantum break crypto? the answer will shock you And other crypto-prophecies.

in 5 years bfswa.substack.com/p/when-will-...

Cryptographers Held an Election. They Can’t Decrypt the Results.

Keys are hard. www.nytimes.com/2025/11/21/w...

Quantum computers will not steal your bitcoins, even if they can The quantum gravity principle

Started a Substack. Subscribe for more crypto investment advice.
bfswa.substack.com/p/quantum-co...

USB: the most successful interface that also brings power We use it every day, but how does it really work? USB has been around for almost 30 years and it evolved into really universal interface ...

I use USB daily but I have no idea how it works 🤔

USB 2 vs USB 3, USB-A vs USB-C, the PD standard… this talk is full of interesting details 💎

And now I even understand why my USB-C power bank doesn’t work with *this* cable unless flipped 🙃

media.ccc.de/v/why2025-25...

pallet of phrack

👀👀👀👀👀👀

5 pallets of zines have landed at @defcon.bsky.social

Decoding RFID: A comprehensive overview of security, attacks, and the latest innovations WHY2025 RFID reverse engineering has seen significant advancements, yet a comprehensive overview of the field remains scattered across research and practitioner communities. Here the authors presents a struc...

🔥 The future of RFID hacking isn’t dead, its even more...

At #WHY2025, Kirils and I are breaking down current RFID hacking situation

No fluff. Just spilling the beans.

🗓️ 9th of August 13:00 at Andromeda
🔗 cfp.why2025.org/why2025/talk...

RT if you’re ready.

Some people keep calling the summer migration to Vegas a camp…

But who will sleep in a tent for real? The ones attending @why2025.bsky.social ⛺️

RWC 2026 call for papers Real World Crypto Symposium

The Call for Contributed Talks is now open for RWC 2026! And the deadline for submissions is now Oct. 10, 2025.
rwc.iacr.org/2026/contrib...

🎙 Ce jeudi, Vincent Strubel, directeur général de l'ANSSI, sera l'invité de l'émission @quotidienofficiel.bsky.social ‬ diffusée sur TMC.

📺 Rendez-vous ce soir à partir de 19h15 sur le canal 10.

Go Cryptography Security Audit Go's cryptography libraries underwent an audit by Trail of Bits. Read more about the scope and results.

Three Trail of Bits engineers audited core Go cryptography for a month and found only one low-sev security issue... in unsupported Go+BoringCrypto! 🍾

Years of efforts on testing, limiting complexity, safe APIs, and readability have paid off! ✨

Yes I am taking a victory lap. No I am not sorry. 🏆

The second Levchin Prize goes to the CADO-NFS team: Emmanuel Thomé, Pierrick Gaudry, and Paul Zimmerman! Congratulations!

#realworldcrypto

Blog: Zen and the Art of Microcode Hacking This blog post covers the full details of EntrySign, the AMD Zen microcode signature validation vulnerability recently discovered by the Google Security team.

Ouch, AMD masterclass in what not to do with cryptography to secure its microcode patching mechanism 😱 ‼️

Private key extraction in ECDSA upon signing a malformed input (e.g. a string) ### Summary Private key can be extracted from ECDSA signature upon signing a malformed input (e.g. a string or a number), which could e.g. come from JSON network input Note that `elliptic` by...

This is a fascinating vulnerability.

The root causes are implementing deterministic signatures instead of hedged, using a general purpose big number implementation, and leaking its API at the crypto layer.

JavaScript types are a red herring, could have happened in any language.

Best practices for key derivation By Marc Ilunga Key derivation is essential in many cryptographic applications, including key exchange, key management, secure communications, and building robust cryptographic primitives. But it’s …

Marc Ilunga has written a nice blog post about "Best practices for key derivation":

Pourquoi peut-on pirater un mot de passe de 10 caractères en 2 semaines, contre 5 mois l'an passé ? CheckNews, le service de fact-checking de Libération, revient sur une infographie partagée par France Numérique expliquant qu'un pirate pouvait, en 2023, pirater un mot de passe de 10 caractères en 2 semaines, alors qu'un tableau ...

@anomalroil.bsky.social : https://www.nextinpact.com/lebrief/71680/pourquoi-peut-on-pirater-mot-passe-10-caracteres-en-2-semaines-contre-5-mois-an-passe

more postquantum https://blog.taurushq.com/quantum-doomsday-planning-2-2-the-post-quantum-technology-landscape/