Your files. Your keys. Your encryption. Post-quantum. Designed for the future.
XChaCha20-Poly1305 · AES-256-GCM · Argon2id · ML-KEM-1024/X448 · ML-DSA-87/Ed448
@nym Privacy works in layers: a network tool, file encryption and key recovery solve different problems. A clear threat model helps people choose what they need. Making those choices understandable for everyday users is a challenge worth taking seriously.
@ProtonDrive "Encrypted" is only the start of the question. Who holds the keys, and can the provider decrypt the files? We're building TMC around local personal file encryption and user-controlled keys, so making that distinction clear is central to our design.
@Magnus_Box The recovery key needs its own backup plan too. An encrypted archive on a separate drive still leaves a point of failure if the only recovery material is on the original device. Do your recovery tests include a completely fresh machine?
@ProtonPrivacy Encrypting a stored document doesn't control a readable copy pasted into another service. People deserve a clear explanation of where their data goes before they click. Local processing is one way to reduce that exposure.
@GrapheneOS The interface work matters. People need to see what is protected and what happens next without understanding the protocol first. We're learning that while developing TMC's local file-encryption app: secure defaults still need a clear, predictable workflow.
@signalapp Restore testing deserves as much attention as creating the backup. Can someone recover their data on a fresh device using only what they saved? Good to see on-device and cross-platform support getting attention.
🇺🇸The FBI was breached because a contractor did not apply a security patch that Google and Oracle flagged as critical in June.
Now we should trust government contractors with our face scans and meta data profiles for age verification so that we can use social media and talk to our friends.
DON’T upload your ID to YouTube.
DON’T upload your ID to Discord.
DON’T upload your ID to Reddit.
DON’T upload your ID to Meta.
DON’T upload your ID to Roblox.
DON’T upload your ID to Spotify.
DON’T upload your ID to ChatGPT.
DON’T upload your ID to TikTok.
Collecting your IP address: “For your protection™”
Banning anonymous access: “For your protection™”
Monitoring everything you do: “For your protection™”
Requiring digital ID: “For your protection™”
Monitoring everyone: “For your protection™”
Scanning your private messages: “For your protection™”
Banning social media: “For your protection™”
Banning VPNs: “For your protection™”
@Sans_Google App support includes the boring essentials: choosing files, encrypted backups and a restore process people can understand. Those have been some of our biggest UX lessons building Tiger Moth. Which everyday workflow is still hardest on a Linux phone?
@KuptoKosmos File encryption protects stored copies. The device also needs to protect the keys and plaintext while a vault is unlocked. That’s why we’re testing Tiger Moth on GrapheneOS too. Locking the vault between uses is a simple habit worth keeping.