{
  "version": "https://jsonfeed.org/version/1.1",
  "title": "DT.gl Digital Trust & Threat Lab",
  "home_page_url": "https://dt.gl/",
  "feed_url": "https://dt.gl/feed.json",
  "language": "en-US",
  "authors": [
    {
      "name": "DT.gl Digital Trust & Threat Lab",
      "url": "https://dt.gl/about"
    }
  ],
  "items": [
    {
      "id": "https://dt.gl/anti-tracking/data-brokers-telemetry",
      "url": "https://dt.gl/anti-tracking/data-brokers-telemetry",
      "title": "Commercial Data Brokers, Mobile Location Telemetry, and Full-Spectrum Anti-Tracking Engineering (2026)",
      "summary": "Commercial data brokers harvest sub-meter mobile coordinates through Real-Time Bidding advertising SDKs, Bluetooth beacons, and vehicle telematics, historically selling warrantless movement graphs to government agencies and private aggregators. Effective 2026 defense combines FTC sensitive-location prohibitions, California DROP statutory deletion, OS advertising-ID zeroing, cellular 2G baseband lockouts, and strict compartmentalization of residential KYC records.",
      "date_published": "2026-11-11T00:00:00Z",
      "date_modified": "2026-11-11T00:00:00Z"
    },
    {
      "id": "https://dt.gl/privacy/decentralized-protocols",
      "url": "https://dt.gl/privacy/decentralized-protocols",
      "title": "Decentralized Social Protocols, Self-Hosted Publishing & Privacy Frontends: 2026 Audit",
      "summary": "Decentralized publishing protocols trade corporate platform lock-in for distinct cryptographic key-management and metadata trade-offs. ActivityPub binds identity to domain-controlled servers, Nostr anchors identity in raw secp256k1 keypairs across dumb relays without native rotation, and AT Protocol introduces rotatable DIDs over verifiable repositories, yet every public federated firehose permanently replicates metadata unless paired with strict endpoint hygiene.",
      "date_published": "2026-11-11T00:00:00Z",
      "date_modified": "2026-11-11T00:00:00Z"
    },
    {
      "id": "https://dt.gl/anti-tracking/encrypted-dns-network",
      "url": "https://dt.gl/anti-tracking/encrypted-dns-network",
      "title": "Encrypted DNS, TLS ECH & Network Metadata Defense: 2026 Protocol Architecture",
      "summary": "Encrypting DNS stops local ISP packet inspection and on-path spoofing, yet standard DoT and DoH merely transfer full domain browsing histories from residential carriers to upstream resolver operators. Achieving genuine network anti-tracking requires decoupling client IP identity from query payloads via Oblivious DoH or Anonymized DNSCrypt, sealing TLS handshakes with Encrypted Client Hello, and isolating sensitive wallet RPC traffic.",
      "date_published": "2026-11-11T00:00:00Z",
      "date_modified": "2026-11-11T00:00:00Z"
    },
    {
      "id": "https://dt.gl/privacy/hardened-os-browsers",
      "url": "https://dt.gl/privacy/hardened-os-browsers",
      "title": "Hardened Mobile Operating Systems & Anti-Fingerprinting Browsers: 2026 Security Matrix",
      "summary": "Operating system and browser hardening must address both commercial telemetry harvesting and zero-click memory-corruption exploits. In 2026 evaluations, GrapheneOS on Armv9 hardware leads mobile exploit defense via hardware Memory Tagging Extension, hardened_malloc, and unprivileged Sandboxed Google Play, while Mullvad Browser and Brave enforce opposing crowd-uniformity versus per-session randomization defenses against high-entropy browser fingerprinting.",
      "date_published": "2026-11-11T00:00:00Z",
      "date_modified": "2026-11-11T00:00:00Z"
    },
    {
      "id": "https://dt.gl/privacy/hardware-keys-and-mcp-security",
      "url": "https://dt.gl/privacy/hardware-keys-and-mcp-security",
      "title": "Hardware Security Keys (FIDO2 / WebAuthn prf) & Agentic MCP Security: 2026 Engineering Guide",
      "summary": "Phishing-resistant authentication and local AI agent security share a single engineering principle: isolating private keys and execution capabilities across hardware-enforced trust boundaries. Hardware FIDO2 security keys bind signatures cryptographically to TLS origins and derive zero-knowledge vault keys via the WebAuthn Level 3 prf extension, while Model Context Protocol servers require digest pinning, Unicode tag sanitization, and rootless container isolation.",
      "date_published": "2026-11-11T00:00:00Z",
      "date_modified": "2026-11-11T00:00:00Z"
    },
    {
      "id": "https://dt.gl/privacy/encrypted-messengers",
      "url": "https://dt.gl/privacy/encrypted-messengers",
      "title": "Encrypted Messaging Protocols & Metadata Resistance: 2026 Cryptographic Audit",
      "summary": "Modern messaging privacy depends equally on post-quantum key ratcheting and metadata graph elimination. In 2026 benchmarks, Signal leads centralized confidentiality via hybrid PQXDH and SPQR ratchets, SimpleX Chat eliminates persistent user identifiers across unidirectional relays, and Briar provides internet-independent Tor, Wi-Fi, and Bluetooth synchronization during state blackouts, whereas Telegram standard cloud chats remain server-readable by default.",
      "date_published": "2026-11-11T00:00:00Z",
      "date_modified": "2026-11-11T00:00:00Z"
    },
    {
      "id": "https://dt.gl/crypto-wallets/on-chain-privacy-protocols",
      "url": "https://dt.gl/crypto-wallets/on-chain-privacy-protocols",
      "title": "On-Chain Privacy Protocols, Stealth Addresses & Non-KYC P2P Architecture",
      "summary": "On-chain privacy protocols vary fundamentally in anonymity-set topology and regulatory resilience. Heuristic mixing and small-ring decoys degrade under statistical timing and poisoned-output attacks, whereas full-chain zero-knowledge membership proofs such as Monero FCMP++ and Zcash Orchard Halo 2 conceal transaction graphs across millions of shielded commitments while stealth standards like BIP-352 eliminate static address reuse.",
      "date_published": "2026-07-02T00:00:00Z",
      "date_modified": "2026-11-11T00:00:00Z"
    },
    {
      "id": "https://dt.gl/crypto-security/major-incidents",
      "url": "https://dt.gl/crypto-security/major-incidents",
      "title": "Major Cryptocurrency Security Incidents and Forensic Post-Mortems (2014-2026 Ledger)",
      "summary": "Between 2020 and 2026, institutional cryptocurrency losses shifted decisively from simple smart-contract reentrancy bugs toward frontend supply-chain injections, multisig blind-signing payload swaps, cross-chain validator compromises, and off-chain EIP-712 or EIP-7702 signature phishing. Defending treasury and personal custody requires independent calldata verification, deterministic clear signing, strict subresource integrity pinning, and compartmentalized hardware quorums.",
      "date_published": "2026-11-11T00:00:00Z",
      "date_modified": "2026-11-11T00:00:00Z"
    },
    {
      "id": "https://dt.gl/privacy/post-quantum-cryptography-fips",
      "url": "https://dt.gl/privacy/post-quantum-cryptography-fips",
      "title": "Post-Quantum Cryptography Engineering Guide: NIST FIPS 203, 204, 205, HQC & Hybrid Migration",
      "summary": "Cryptographically relevant quantum computers running Shor's algorithm will break RSA, X25519, and ECDSA, exposing recorded classical traffic to Harvest Now, Decrypt Later decryption. NIST finalized FIPS 203 (ML-KEM), FIPS 204 (ML-DSA), and FIPS 205 (SLH-DSA), plus selected code-based HQC as a non-lattice backup KEM; engineers should deploy hybrid X25519MLKEM768 key exchange immediately across TLS 1.3, OpenSSH, and file encryption.",
      "date_published": "2026-11-11T00:00:00Z",
      "date_modified": "2026-11-11T00:00:00Z"
    },
    {
      "id": "https://dt.gl/crypto-wallets/self-custody-privacy",
      "url": "https://dt.gl/crypto-wallets/self-custody-privacy",
      "title": "Crypto Wallets, Silicon Trust Models & RPC Anti-Tracking Engineering",
      "summary": "True cryptocurrency self-custody requires defending two distinct planes simultaneously: private-key extraction resistance on silicon and network metadata isolation on transport. Even an air-gapped hardware signer loses all financial privacy if its companion desktop or browser wallet broadcasts unbatched JSON-RPC balance queries over a residential IP address, linking every derived HD account before a single transaction enters the mempool.",
      "date_published": "2026-06-15T00:00:00Z",
      "date_modified": "2026-11-11T00:00:00Z"
    },
    {
      "id": "https://dt.gl/incidents/bybit-safe-multisig-2025",
      "url": "https://dt.gl/incidents/bybit-safe-multisig-2025",
      "title": "DT-INC-2025-001: Bybit $1.46B Safe Multisig UI Supply-Chain & Slot-0 Delegatecall Post-Mortem",
      "summary": "On February 21, 2025, DPRK Lazarus Group operators drained 1.46 billion USD in ETH and liquid-staked derivatives from Bybit's Ethereum cold multisig without exploiting any smart contract bug. Compromising a Safe developer workstation allowed attackers to inject targeted AWS S3 frontend JavaScript that tricked three hardware-wallet signers into blind-signing an operation=1 DELEGATECALL overwriting proxy storage slot zero.",
      "date_published": "2026-06-18T00:00:00Z",
      "date_modified": "2026-11-11T00:00:00Z"
    },
    {
      "id": "https://dt.gl/incidents/eip-7702-sweeper-delegations-2025",
      "url": "https://dt.gl/incidents/eip-7702-sweeper-delegations-2025",
      "title": "DT-INC-2025-002: Ethereum Pectra EIP-7702 EOA Sweeper Delegations & Chain-ID Zero Replay Analysis",
      "summary": "Following Ethereum's May 7, 2025 Pectra hard fork, commercial drainer syndicates shifted over 80 percent of malicious delegations to EIP-7702 Type-0x04 SET_CODE authorization tuples. A single off-chain signature over MAGIC byte 0x05 binds an externally owned account's code pointer to 0xef0100 plus a sweeper contract, draining native ETH and multiple ERC-20 tokens atomically and across all EVM chains when chain_id equals zero.",
      "date_published": "2026-07-14T00:00:00Z",
      "date_modified": "2026-11-11T00:00:00Z"
    },
    {
      "id": "https://dt.gl/incidents/ledger-connect-kit-supply-chain",
      "url": "https://dt.gl/incidents/ledger-connect-kit-supply-chain",
      "title": "DT-INC-2023-009: Ledger Connect Kit NPM & jsDelivr CDN Supply-Chain Injection Post-Mortem",
      "summary": "On December 14, 2023, an attacker used a phished former Ledger employee's unrevoked NPM automation token to publish malicious versions 1.1.5 through 1.1.7 of @ledgerhq/connect-kit containing Angel Drainer. Because Ledger's loader package dynamically fetched unpinned latest JavaScript from jsDelivr CDN without Subresource Integrity hashes, dozens of innocent DeFi frontends served wallet-draining modals simultaneously for nearly five hours.",
      "date_published": "2026-06-24T00:00:00Z",
      "date_modified": "2026-11-11T00:00:00Z"
    },
    {
      "id": "https://dt.gl/incidents/tornado-cash-van-loon-sanctions",
      "url": "https://dt.gl/incidents/tornado-cash-van-loon-sanctions",
      "title": "DT-INC-2025-003: Tornado Cash OFAC Sanctions, Fifth Circuit Van Loon Reversal & Immutable ZK Law",
      "summary": "On November 26, 2024, the U.S. Court of Appeals for the Fifth Circuit ruled unanimously in Van Loon v. Department of the Treasury that Tornado Cash's immutable Groth16 zero-knowledge pool smart contracts cannot be owned, controlled, or altered by any person and therefore exceed Treasury's statutory property-sanctioning authority under IEEPA, prompting OFAC's formal SDN delisting on March 21, 2025.",
      "date_published": "2026-07-08T00:00:00Z",
      "date_modified": "2026-11-11T00:00:00Z"
    },
    {
      "id": "https://dt.gl/tools/calldata-signature-auditor",
      "url": "https://dt.gl/tools/calldata-signature-auditor",
      "title": "Offline EVM Calldata, EIP-712 Safe Hash & EIP-7702 Risk Visualizer",
      "summary": "The DT.gl Calldata and Signature Auditor decodes raw EVM hexadecimal payloads, EIP-712 typed structures, and EIP-7702 SetCode authorization tuples entirely inside a network-isolated browser tab. It computes deterministic Keccak-256 Safe multisig domain and transaction hashes locally while flagging proxy storage takeover vectors such as operation 1 DELEGATECALL before hardware confirmation.",
      "date_published": "2026-11-11T00:00:00Z",
      "date_modified": "2026-11-11T00:00:00Z"
    },
    {
      "id": "https://dt.gl/tools/location-databroker-exposure-auditor",
      "url": "https://dt.gl/tools/location-databroker-exposure-auditor",
      "title": "Mobile Telemetry, Data-Broker Risk Scorer & Statutory Opt-Out Generator",
      "summary": "The DT.gl Location and Data-Broker Exposure Auditor evaluates fourteen commercial mobile RTB, carrier CPNI, vehicle telematics, and crypto-KYC correlation vectors entirely inside a connect-src none browser sandbox. It generates ready-to-send statutory deletion and suppression demands under the California Delete Act DROP platform, CCPA/CPRA, and GDPR Article 17 with zero PII uploaded.",
      "date_published": "2026-11-11T00:00:00Z",
      "date_modified": "2026-11-11T00:00:00Z"
    },
    {
      "id": "https://dt.gl/tools/seed-multisig-entropy-lab",
      "url": "https://dt.gl/tools/seed-multisig-entropy-lab",
      "title": "Offline Seed Entropy, GF(256) Shamir & Multisig Quorum Lab",
      "summary": "The DT.gl Seed Entropy and Multisig Quorum Lab audits physical dice and coin randomness using Shannon entropy and Pearson chi-square bias statistics, demonstrates polynomial Shamir Secret Sharing over finite field GF(256) via Lagrange interpolation, and models M-of-N hardware multisig versus threshold MPC survival under coercion, fire loss, and firmware compromise.",
      "date_published": "2026-11-11T00:00:00Z",
      "date_modified": "2026-11-11T00:00:00Z"
    },
    {
      "id": "https://dt.gl/tools/wallet-tracking-exposure-auditor",
      "url": "https://dt.gl/tools/wallet-tracking-exposure-auditor",
      "title": "Wallet RPC Leak, UTXO Boltzmann Entropy & Address-Poisoning Auditor",
      "summary": "The DT.gl Wallet Tracking Exposure Auditor models off-chain JSON-RPC batch correlation across multi-account deterministic wallets, calculates exact Bitcoin UTXO Boltzmann partition entropy and deterministic link probabilities in local memory, and detects GPU-mined vanity address-poisoning collisions. Enforcing connect-src none guarantees that zero wallet addresses or UTXO amounts ever leave your browser.",
      "date_published": "2026-11-11T00:00:00Z",
      "date_modified": "2026-11-11T00:00:00Z"
    },
    {
      "id": "https://dt.gl/tools/anti-tracking-inspector",
      "url": "https://dt.gl/tools/anti-tracking-inspector",
      "title": "Zero-Telemetry Browser Fingerprint, TLS/ECH & URL Sanitizer Workbench",
      "summary": "The DT.gl Browser Anti-Tracking Inspector audits client-side fingerprinting vectors in local memory, measuring Canvas subpixel rendering hashes, WebGL GPU strings, OfflineAudioContext dynamics, W3C Global Privacy Control signals, and WebRTC candidate leaks. It strips seventy-two URL tracking parameters offline and provides an opt-in stateless edge echo for TLS 1.3 and Encrypted Client Hello verification.",
      "date_published": "2026-11-11T00:00:00Z",
      "date_modified": "2026-11-11T00:00:00Z"
    },
    {
      "id": "https://dt.gl/tools/metadata-unicode-sanitizer",
      "url": "https://dt.gl/tools/metadata-unicode-sanitizer",
      "title": "Zero-Upload Binary Metadata Stripper & Unicode MCP Injection Scanner",
      "summary": "The DT.gl Metadata and Unicode Sanitizer parses raw binary file buffers inside a network-isolated browser tab to strip JPEG EXIF GPS tags, Adobe XMP packets, C2PA manifests, and PNG Stable Diffusion or ComfyUI workflow chunks without recompression. A companion scanner detects invisible Plane-14 Unicode Tags, bidirectional overrides, and homographs used in MCP prompt injection.",
      "date_published": "2026-11-11T00:00:00Z",
      "date_modified": "2026-11-11T00:00:00Z"
    },
    {
      "id": "https://dt.gl/advisories#dt-adv-2026-001",
      "url": "https://dt.gl/advisories#dt-adv-2026-001",
      "title": "DT-ADV-2026-001: NIST Selects Code-Based HQC as Fifth Post-Quantum Standard Alongside IR 8547 Deprecation Milestones",
      "summary": "NIST selected Hamming Quasi-Cyclic (HQC) from Round 4 candidates as its fifth post-quantum cryptographic standard, providing a code-based Key-Encapsulation Mechanism independent of structured algebraic lattices. ML-KEM (FIPS 203) remains the primary production default across TLS 1.3 and OpenSSH, while HQC establishes cryptanalytic defense-in-depth ahead of NIST IR 8547's 2030 classical deprecation deadline.",
      "date_published": "2026-01-22T00:00:00Z",
      "date_modified": "2026-11-11T00:00:00Z"
    },
    {
      "id": "https://dt.gl/advisories#dt-adv-2026-002",
      "url": "https://dt.gl/advisories#dt-adv-2026-002",
      "title": "DT-ADV-2026-002: FTC Final Enforcement Orders Against Gravy Analytics / Venntel & Mobilewalla + California DROP Launch",
      "summary": "Landmark Federal Trade Commission enforcement orders against Gravy Analytics, its subsidiary Venntel, and Mobilewalla prohibit the unlawful sale of non-consensual mobile advertising SDK location trails and mandate deletion of historic geolocation archives. Paired with California's 2026 Delete Request and Opt-Out Platform (DROP), statutory remedies now reinforce OS-level mobile sensor and ad-ID lockdown.",
      "date_published": "2026-02-09T00:00:00Z",
      "date_modified": "2026-11-11T00:00:00Z"
    },
    {
      "id": "https://dt.gl/advisories#dt-adv-2026-003",
      "url": "https://dt.gl/advisories#dt-adv-2026-003",
      "title": "DT-ADV-2026-003: Active Exploitation of Ethereum Pectra EIP-7702 (0x04 SET_CODE) Delegations by Automated Sweeper Contracts",
      "summary": "Following Ethereum's Pectra upgrade, wallet-drainer syndicates weaponized EIP-7702 type-0x04 SET_CODE authorization tuples to attach persistent malicious smart-contract code (0xef0100 || address) directly onto victim Externally Owned Accounts. Signing a single off-chain authorization with chain_id = 0 allows attackers to sweep ETH and ERC-20 deposits automatically across every EVM chain simultaneously.",
      "date_published": "2026-05-14T00:00:00Z",
      "date_modified": "2026-11-11T00:00:00Z"
    },
    {
      "id": "https://dt.gl/advisories#dt-adv-2026-004",
      "url": "https://dt.gl/advisories#dt-adv-2026-004",
      "title": "DT-ADV-2026-004: CalyxOS v7.2.2.0 Production Relaunch Under Open-Source HSM Code-Signing Governance",
      "summary": "Following a multi-month OTA freeze triggered by 2025 leadership transitions at the Calyx Institute, CalyxOS resumed production builds in July 2026 with version 7.2.2.0 (Android 16) signed by a newly provisioned open-source Hardware Security Module (HSM) infrastructure. Legacy pre-pause installations require verified key-lineage migration, while GrapheneOS retains exclusive Armv9 MTE memory hardening.",
      "date_published": "2026-07-18T00:00:00Z",
      "date_modified": "2026-11-11T00:00:00Z"
    }
  ]
}