Matthew Green
@matthewdgreen.bsky.social
📤 18012
📥 406
📝 1902
I teach cryptography at Johns Hopkins.
https://blog.cryptographyengineering.com
Where’s Waldo?
about 16 hours ago
2
39
2
Petition to move the winter holidays to July so we can just work through this gray time.
about 19 hours ago
7
29
1
I was stupid enough to buy this new AppleCare One plan for a phone I bought my daughter. Now I learn this only covers the device if it’s connected to the same Apple ID (not family plan). Have to spend Christmas unwinding this and getting a refund, what a drag.
4 days ago
4
29
1
If we can’t solve hallucinations, OpenAI should fund a service to actually write the academic papers that ChatGPT hallucinates.
11 days ago
6
33
3
Watching the HN folks discuss the state of user privacy in 2025 is pretty depressing.
news.ycombinator.com/item?id=4630...
loading . . .
TikTok unlawfully tracks shopping habits and use of dating apps? | Hacker News
https://news.ycombinator.com/item?id=46307500
11 days ago
2
18
3
reposted by
Matthew Green
ePrint Updates
11 days ago
Efficient Privacy-Preserving Blueprints for Threshold Comparison (Pratyush Ranjan Tiwari, Harry Eldridge,
Matthew Green
)
ia.cr/2025/2253
0
5
3
If you’re a cryptographer and you got one of these, send me an email.
11 days ago
13
74
27
Imagine it’s 2013 and you see this document from the UK sent back from the future. You’ll assume something went very wrong in that timeline.
13 days ago
6
39
13
I’m sure I should have been vibe coding with a proper IDE rather than copy/paste from an LLM, but man does AI-generated code get confusing and spaghetti after a few fixes. You have to force it to use subroutines or it’ll just produce special case after special case in one massive routine.
15 days ago
7
60
9
reposted by
Matthew Green
Alberto Fittarelli
17 days ago
1/ Yesterday’s Q2-Q3 Adversarial Threat Report by Meta was interesting in many ways. For us
@citizenlab.ca
, it was a blast from the past. For the first time, Meta’s investigators attributed what in 2019 we had named Endless Mayfly - a relentless, sophisticated influence op targeting Iran’s enemies.
loading . . .
Burned After Reading: Endless Mayfly’s Ephemeral Disinformation Campaign - The Citizen Lab
Using Endless Mayfly as an illustration, this highlights the challenges of investigating & addressing disinformation from research & policy perspectives.
https://citizenlab.ca/2019/05/burned-after-reading-endless-mayflys-ephemeral-disinformation-campaign/
1
18
14
reposted by
Matthew Green
Jay Fieldy
17 days ago
Europol wants to be able to break end-to-end encryption after court order (dutch article):
www-security-nl.translate.goog/posting/9170...
loading . . .
Europol wil end-to-end encryptie na gerechtelijk bevel kunnen doorbreken
Europol wil de mogelijkheid hebben om end-to-end versleutelde communicatie van verdachten, na toestemming van de rechter, te ...
https://www-security-nl.translate.goog/posting/917020/Europol+wil+end-to-end+encryptie+na+gerechtelijk+bevel+kunnen+doorbreken?_x_tr_sl=auto&_x_tr_tl=en&_x_tr_hl=nl&_x_tr_pto=wapp
3
4
6
reposted by
Matthew Green
Steve Syfuhs
19 days ago
Last week I announced that we're finally killing off RC4 in the Windows Kerberos stack. This has been a long time coming, so much so that we've been working on it for more than a decade, albeit off and on as we sometimes had to target other more pressing issues. What does this mean?
loading . . .
Beyond RC4 for Windows authentication
As organizations face an evolving threat landscape, strengthening Windows authentication is more critical than ever.
https://www.microsoft.com/en-us/windows-server/blog/2025/12/03/beyond-rc4-for-windows-authentication
3
86
28
reposted by
Matthew Green
Alec Muffett
18 days ago
AND FINALLY: UK House of Lords demands client-side scanning of content to check for “viewing of CSAM”
https://alecmuffett.com/article/134940
#AgeVerification
#ClientSideScanning
#OnlineSafety
#OnlineSafetyAct
#censorship
#surveillance
#vpn
loading . . .
AND FINALLY: UK House of Lords demands client-side scanning of content to check for “viewing of CSAM”
There’s a kind of Orwellian inevitability to this: “Action to promote the wellbeing of children by combating child sexual abuse material (CSAM) … (2) The “CSAM requirement” is that any …
https://alecmuffett.com/article/134940
0
10
10
So I’m on the verge of giving up and just piping my email into an LLM so I don’t have to feel guilty about not being able to read it.
18 days ago
3
26
0
Hey, Microsoft is getting rid of RC4-based NTLM key derivation!
www.microsoft.com/en-us/window...
loading . . .
Beyond RC4 for Windows authentication
As organizations face an evolving threat landscape, strengthening Windows authentication is more critical than ever.
https://www.microsoft.com/en-us/windows-server/blog/2025/12/03/beyond-rc4-for-windows-authentication
19 days ago
2
34
4
I used the word invariant the other day in conversation and I don’t like myself for it.
24 days ago
2
21
0
I told my son about my first programming project that other people used, a Mac Desk Accessory that could shut down the computer. So he asked ChatGPT if there was any evidence of it left online.
25 days ago
5
49
9
If super-intelligent AI is coming (and we avoid all the bad things), I feel like philosophy is the only degree worth getting. It’s amazing to me that the tech world hasn’t figured that out.
28 days ago
6
28
5
Trying to think of something serious to say about the “cryptographers lose the key for the cryptographer election” story and, mostly, hey: I just love that cryptographers are actually using the weird cryptography!
www.nytimes.com/2025/11/21/w...
loading . . .
Cryptographers Held an Election. They Can’t Decrypt the Results.
https://www.nytimes.com/2025/11/21/world/cryptography-group-lost-election-results.html?smid=nytcore-ios-share
about 1 month ago
8
102
14
Keys are hard.
www.nytimes.com/2025/11/21/w...
loading . . .
Cryptographers Held an Election. They Can’t Decrypt the Results.
https://www.nytimes.com/2025/11/21/world/cryptography-group-lost-election-results.html?smid=nytcore-ios-share
about 1 month ago
17
252
79
reposted by
Matthew Green
tweety fish
about 1 month ago
cloudflare's on-duty IT staff bangs on the doors which I have padlocked from the inside as I calmly break open lava lamp after lava lamp and drink the contents
19
2118
573
Everything in MPC and ZK comes down to how many sequential multiplications a private computation requires. In (non-interactive ZK) the answer is basically two, whereas in MPC the answer is “many” unless we’re willing to decompose the computation into many rounds.
about 1 month ago
1
14
0
A wild rumor I heard: US agencies that purchase vulnerabilities have explicitly told their vendors *not* to bring them vulnerabilities in encryption protocols (like Signal or WhatsApp), unless they want those vulnerabilities disclosed/fixed. (Take this with a mountain of salt.)
about 1 month ago
1
41
5
reposted by
Matthew Green
Brendan Nyhan
about 1 month ago
Mafia governance in action "the only offer on the table was that I needed to resign by 5pm that day or the DOJ would basically rain hell on UVA... If I did not resign that day, I was told that the DOJ would extract/block hundreds of millions of dollars from UVA before they would even negotiate."
add a skeleton here at some point
27
1085
528
reposted by
Matthew Green
Łukasz
about 1 month ago
Law enforcement: we need to break encryption to get access to Signal to protect the children!! Also law enforcement: for years couldn’t catch a pedophile sex trafficker who used email to coordinate all of his pedophile sex trafficking
0
125
47
The 18y/o asked me how LZW compression worked at dinner tonight and I was like “oh [vague stuff about building a dictionary]” and he was like yeah, obviously but how do they build the dictionary, and I realized for the 6627th time that I know 0.1% of computer science and then our cheesesteak came.
about 2 months ago
7
94
1
It’s pretty funny that end-to-end encryption is safer from the US government than it’s ever been, and the reason is criminal corruption.
about 2 months ago
0
47
8
One of the most interesting recent privacy developments is the deployment of big two-hop IP blinding VPNs by companies like Apple and Google. These systems are designed to ensure that even those companies can’t link web requests to IP addresses.
about 2 months ago
5
84
29
Who named these AirPods.
about 2 months ago
3
28
2
reposted by
Matthew Green
Mike Stabile
about 2 months ago
After initially confirming the project to Tech Radar, Ofcom went silent when pressed on questions about what data was being monitored, what privacy protections were in place or who the company doing it was.
2
258
75
reposted by
Matthew Green
Mike Stabile
about 2 months ago
The British government admits it is now monitoring VPNs use by UK residents. Regulator Ofcom has contracted with an AI-powered surveillance service to detect the number of citizens using VPNs to evade the Online Safety Act. The UK tech minister has said a VPN ban is on the table.
loading . . .
Exclusive: Ofcom is monitoring VPNs following Online Safety Act. Here's how
Ignoring VPNs risks creating ineffective laws, but tracking them threatens people's privacy
https://www.techradar.com/vpn/vpn-privacy-security/exclusive-ofcom-is-monitoring-vpns-following-online-safety-act-heres-how
58
686
826
Are there any actual AI agents out there that can reliably perform tasks for you?
about 2 months ago
9
9
1
reposted by
Matthew Green
Brendan Nyhan
about 2 months ago
A staggering statistic: "North American researchers were charged over US$2.27 billion by just two for-profit publishers. The Canadian research councils and the US National Science Foundation were allocated US$9.3 billion in that year." What are we doing?
add a skeleton here at some point
3
108
66
reposted by
Matthew Green
Karl Bode
about 2 months ago
The Trump administration's cybersecurity policies are indistinguishable from a foreign attack. In many ways they're worse, given they're wrapped in layers of phony operational efficiency.
loading . . .
Trump Cybersecurity Policy Is Indistinguishable From A Foreign Attack
Last year almost a dozen major U.S. ISPs were the victim of a massive, historic intrusion by Chinese hackers who managed to spy on public U.S. officials for more than a year. The “Salt Ty…
https://www.techdirt.com/2025/11/07/trump-cybersecurity-policy-is-indistinguishable-from-a-foreign-attack/
5
178
81
Imagine how bad things are going to be when these morons actually stumble into AI.
about 2 months ago
9
97
11
I was brought up in the era of “without random oracles” and so the increasing dependence on weird random oracle stuff in all our crypto really bums me out.
about 2 months ago
2
30
1
The password has been changed to “Louvre2”, don’t worry
add a skeleton here at some point
about 2 months ago
8
118
22
reposted by
Matthew Green
Perry Areolar
about 2 months ago
the password to the louvre surveillance server was "louvre"
www.thesocialpost.it/2025/11/02/f...
316
11161
4840
reposted by
Matthew Green
CAMERON WILSON
about 2 months ago
It's one month until Australia's internet will drastically change. Here's what I'm doing to cover it: (PS: I’ve set up a mailing list to send out an email when I have an article come out, instead of than hoping that an algorithm will serve it to you:
camwilson.beehiiv.co...
)
9
82
32
I remain not panicked about side channel attacks.
about 2 months ago
7
65
12
Wow hardcover books have become luxury items all of a sudden.
about 2 months ago
5
20
1
Did Apple push the “make old iPhone batteries die really fast” update this week?
about 2 months ago
8
31
2
reposted by
Matthew Green
Ian Miers
about 2 months ago
There's no such thing as Fully-Homomorphic Decryption. Anytime you see a system using FHE to compute on your sensitive data, remember: someone has the key. If its not you, do you trust them?
2
26
6
I’m no expert, but it seems like with a little processing you could get a lot of facial information from a thin mask drawn tight against the wearer’s face. Apropos of nothing much.
about 2 months ago
3
32
5
reposted by
Matthew Green
Jay Fieldy
about 2 months ago
Good news about chatcontrol:
politiken.dk/viden/art106...
loading . . .
Hummelgaard opgiver kontroversielt forslag om overvågning
Viden og Tech | Vi dækker den teknologiske verden, ai og tech-giganternes evige kamp. Læs om den digitale velfærdsstat i temaet 'Den digitale underklasse'.
https://politiken.dk/viden/art10605607/Hummelgaard-opgiver-kontroversielt-forslag-om-overv%C3%A5gning
0
1
2
reposted by
Matthew Green
Lex
about 2 months ago
The trajectory for digital ID and infrastructure was mainly stagnant for years because of the lack of public demand for it (for obvious reasons). But once governments and businesses saw ways to use it to allegedly prevent fraud and age gate the web, that was a large incentive to roll this out faster
0
7
2
reposted by
Matthew Green
Joseph Menn
about 2 months ago
Sure, why require telcos to have cybersecurity plans?
www.cybersecuritydive.com/news/fcc-cyb...
loading . . .
FCC will vote to scrap telecom cybersecurity requirements
The commission’s Republican chair, who voted against the rules in January, calls them ineffective and illegal.
https://www.cybersecuritydive.com/news/fcc-cybersecurity-telecommunications-carriers-brendan-carr-eliminate-rules/804259/
9
72
51
reposted by
Matthew Green
Nina "Erina" Satragno
about 2 months ago
The PRF extension is designed to be used for end-to-end encryption. It's a good fit for them!
bitwarden.com/blog/prf-web...
loading . . .
PRF WebAuthn and its role in passkeys | Bitwarden
Accessing and unlocking the Bitwarden vault with a passkey leverages an extension for WebAuthn called the pseudo-random function or PRF. Learn more about this leading-edge standard and how it may impa...
https://bitwarden.com/blog/prf-webauthn-and-its-role-in-passkeys/
1
11
4
reposted by
Matthew Green
Deirdre Connolly¹ ²
about 2 months ago
what; Passkeys are a web-based authentication scheme, not an encryption scheme
add a skeleton here at some point
2
21
7
Not to brag, but I’m a two time Test of Time winner now. Ok I’m bragging.
2 months ago
7
66
3
Load more
feeds!
log in