After a long day of exhausting conversations about Hybrid Post-Quantum Cryptography, random jackasses trying to play gotcha with endpoint attacks against end-to-end encrypted messaging apps, and me…
Dhole Moments - Software, Security, Cryptography, and Furries
Writings about information security, cryptography, software, and humanity, from a member of the furry fandom with a dhole fursona.
Hybrid Constructions: The Post-Quantum Safety Blanket - Dhole Moments
The funny thing about safety blankets is they can double as stage curtains for security theater. Art: CMYKat “When will a cryptography-relevant quantum computer exist?” is a question ma…
Wave - Secure Messaging App
Privacy-first messaging with quantum-level encryption. No signup, fully decentralized, zero tracking.
A Post-Quantum Future for Let's Encrypt
Let’s Encrypt is committed to a post-quantum-safe Web PKI. The path we’re planning to take is Merkle Tree Certificates (“MTCs”), a new approach that adds post-quantum authentication to the web without sacrificing the speed and reliability that have made TLS universal. This post is about these plans and why we believe MTCs are worth pursuing as a key to a post-quantum future. An increasingly urgent problem For much of the last several years, the conversation about post-quantum cryptography has been a conversation about encryption. The reasoning was straightforward: an attacker who records encrypted traffic today might be able to decrypt it years from now once quantum computers can break the underlying math. Authentication, the part of TLS that indicates a server is who it says it is, has been a less urgent problem. A quantum computer needs to forge a signature in real time, not retroactively, so threats to authentication hinge on the existence of a cryptographically relevant quantum computer (CRQC).
Is End-to-End Encryption Optional For Large Groups? - Dhole Moments
One of the recent topics in Messaging App Discourse is whether it makes sense to prioritize End-to-End Encryption (E2EE) when searching for an alternative to Discord. Who’s Saying “No&#…
Strangeness, illegibility, hardness
An update from our Protocol Fiction special interest group
A Cryptography Engineer’s Perspective on Quantum Computing Timelines
The risk that cryptographically-relevant quantum computers materialize within the next few years is now high enough to be dispositive, unfortunately.
Nicholas Carlini - Black-hat LLMs | [un]prompted 2026
Web Crypto’s SubtleCrypto: A Masterclass in Developer Hostility and How It Strangles the Modern Web
Not Subtle, Just Sabotage — An API Against the Web
ATSMS — end-to-end encrypted group messaging
Encrypted group messaging on AT Protocol identities, with no server ordering anything.
Why Anthropic believes its latest model is too dangerous to release
“The language models we have now are probably the most significant thing to happen in security since we got the Internet.”
Meet the Pirates of the RAG: Adaptively Attacking LLMs to Leak Knowledge Bases
Meet the Pirates of the RAG: Adaptively Attacking LLMs to Leak Knowledge Bases
Claude says “You're absolutely right!” about everything | Hacker News
I'm fairly well versed in cryptography. A lot of other people aren't, but they wish they were, so they ask their LLM to make some form of contribution. The result is high level gibberish. When I prod them about the mess, they have to turn to their LLM to deliver a plausibly sounding answer, and that always begins with "You are absolutely right that [thing I mentioned]". So then I don't have to spend any more time wondering if it could be just me who is too obtuse to understand what is going on.
New prompt injection papers: Agents Rule of Two and The Attacker Moves Second
Two interesting new papers regarding LLM security and prompt injection came to my attention this weekend. Agents Rule of Two: A Practical Approach to AI Agent Security The first is …
