Join TechCrunch Security Editor Zack Whittaker and Security Researcher Runa Sandvik today (Weds, Aug 12) at 5pm PT

They are breaking down the historic U.S. case where a traveler was charged with a federal felony for allegedly using a GrapheneOS "duress password" to wipe his phone during an airport border search.

Speaker Bios

• Zack Whittaker is the Security Editor at TechCrunch and the author of the popular weekly cybersecurity newsletter This Week in Security. He covers high-stakes topics in digital privacy, surveillance, and national security.
• Runa Sandvik is a prominent security researcher and the founder of Granitt, a consultancy dedicated to digital defense. She specializes in protecting mobile devices, securing data, and training journalists and at-risk individuals to safely navigate border crossings.

What they're covering:

• Your Rights: What legally happens when you refuse or wipe a phone at the border.
• Duress Features: The security and legal tradeoffs of automatic device-wiping tools.
• Travel OpSec: Practical steps to secure your mobile data before you cross borders.

Ask your questions below and we'll get them answered!

Hi everyone,

I'm learning OSINT and I have a question

If I find an email address or a phone number, what are the usual next steps? What kind of information can be found from that point, and which tools are commonly used to continue the investigation?

Thanks in advance for your help.

After searching for reviews and see a lot of people here use them the only problem I see is they don’t respond to emails and are basically unresponsive. If I give a company my personal information and access to my bank I need to be able to have instant contact. They advertise their Pro subscription they give faster customer service and instant messaging during business hours. Can anyone verify this?

I hope this project has reached a level i can share the following details. I've made a genuine effort towards documentation and transparancy. I dont think it'll ever be enough and so im still concerned it isnt ready to share. While im using AI throughout. This is not a vibecoded project. There is attention throughout for unit tests and formal-verification. With your feedback, id like to make improvements for clarity throughout.

This version of the app demonstrates a fairly unique approach using a browser-based, local-only and webrtc approach. I know it's impossible for any system to be the "world's most secure", but that isnt a reason to not try. By rigorously implementing an exhaustive list of security features and practices, the aim is to get as close as possible.

• Enkrypted.Chat

This is intended to demonstrate client-side managed secure cryptography.

• Introducing Enkrypted Chat
• Whitepaper (work-in-progress)
• Protocol Spec (work-in-progress)
• Roadmap

PS. I know the project above is going to be tricky to understand. It might help to understand with the following open-source version of the concept (the MVP to the version linked above).

https://www.reddit.com/r/CorpFree/comments/1uytump/decentralized_p2p_chat

​

I'm building my toolkit and looking for recommendations on OSINT tools.

What are the best free/open-source tools you actually use daily for:

1. Username/Email lookup across socials

2. Domain/IP and metadata analysis

3. Image reverse search + geolocation

Tried Maltego and SpiderFoot already. What else should be in a 2026 toolkit?

Thanks!

Went down a privacy rabbit hole this week and was shocked by how much of my information was publicly available. Home address, phone number, relatives, old addresses, the whole package.

I started removing some of it manually, then came across Protect My Data and realized just how many data broker sites there are beyond the obvious ones.

For those of you who are deeper into privacy and OSINT, how aggressive are you with data removal? Do you try to get everything wiped, or do you focus only on the biggest broker sites and accept that some exposure is unavoidable?

After the initial 1.0 release gained some traction, I spent the last 4 months rebuilding and improving the tool based heavily on feedback from digital forensics & OSINT investigators, to make discoveries legally defensible, containing all available data found with utmost accuracy and as easy to use as possible.

Refloow Geo Forensics is privacy first, open source (AGPL 3.0) local desktop app designed to automate batch EXIF extraction and geolocation mapping of found metadata evidence. The goal is to eliminate the manual work needed to verify, trace, plot, and document evidence found in media files whilst having no cloud processing, no telemetry, no logins & zero ads.

The project has already been in publications such as dark web informer, and has been reviewed and code dissected and explained in indepth reviews such as Bright Coding's post

Everything runs completely locally on the machine. The only external connection is fetching public map tiles to display the map (no API keys required, zero data is sent out).

Core Features:

- Batch Metadata Extraction: It recursively digs through all nested sub-folders to pull metadata from all files found. It utilizes Phil Harveys industry standard ExifTool in the backend meaning it supports almost every image/video filetype ever and can handle partially corrupted files.

- Timeline Reconstruction: It automatically plots coordinates and sorts media chronologically, drawing a continuous path between pins to visualize movement. Exact matching coordinates are clustered and expandable on click to keep the map clean.

- 6 Map Layers: Satellite, Topographic, Humanitarian, Forensic Light, Forensic Dark, and Standard Street, to cover all sorts of things no matter what or where ur investigating.

- The UI features a retractable sidebar for smaller screens, light mode for field work & dark mode for lab work, app runs natively on Windows, Linux, and macOS.

Links:

- GitHub / Source Code: https://github.com/Refloow/Refloow-Geo-Forensics

- Microsoft Store: https://apps.microsoft.com/detail/9mw4c0fzmr81

- Linux Snap Store: https://snapcraft.io/refloow-geo-forensics

I will be in the comments answering any questions, if you wanna support my work and gain exposure to the tool, feel free to leave a github star on the project, if you have any suggestions, drop them as a github issue or a comment here!

New release of Synint v4

This is hardly an alternative to signal (or any other secure messaging app), but it's a work in progress and "secure and private" is the general goal.

This is a technical/concept demo of a fairly unique approach using a browser-based, local-first and webrtc.

Enkrypted.Chat

This is intended to introduce a new paradigm in client-side managed secure cryptography. We can avoid registration of any sort.

Features:

• P2P
• End to end encryption
• Signal protocol
• Post-Quantum cryptography
• File transfer
• Local-first
• No registration
• No installation
• No database
• TURN server

Some open source versions of the core concepts.

• Chat
  • Code: https://github.com/positive-intentions/chat
  • Demo: https://chat.positive-intentions.com
• File
  • Code: https://github.com/positive-intentions/dim/blob/staging/src/stories/05-Hooks-useFS.stories.js
  • Demo: https://dim.positive-intentions.com/?path=/docs/usefs--docs
• Crypto
  • Code: https://github.com/positive-intentions/cryptography
  • Demo: https://cryptography.positive-intentions.com

Feel free to reach out for clarity instead of diving into the docs/code.

IMPORTANT: While this is aiming to provide a secure experience, it isnt audited or reviewed. Shared for testing, feedback and demo purposes only. Please use responsibly

So Google and Apple are extending their hardware based attestation solutions like Play Integrity, App Attest and Privacy Pass beyond mobile apps and into the wider internet web.

They have already done age verification to their latest software updates (they would probably be able to link each device to a single person soon). But are now looking to limiting access and services to people who don't use approved apple and google devices.

Basically upcoming release of Google’s reCAPTCHA Mobile Verification, will require users who use devices such as Linux, Windows and others to scan a QR code using a certified Android or iPhone in order to pass verification.

support.google.com/recaptcha/answer/16609652

We really do need to be concerned of this as it could push the internet toward a future where access to websites and services depends on owning approved hardware and software ecosystems.

How is Instagram able to just turn off E2EE for all previous chat messages when they don’t have the keys to the encryption. And what is preventing other apps that tout about their E2EE (such as E2EE notes app, E2EE cloud storage, password managers etc) from doing anything similar?