Topic
privacy
11 stories about privacy—and the choices behind the technology we make.
← Back to all storiesCopilot will act on your PC "with your permission". Who gets to click Allow on your passwords?
Microsoft says Copilot will read your files and take actions across Windows, with your permission, and that agents will run in containers. Neither post says a word about passwords or sign-in. What an agent on your own PC can reach, and how to make sure a click isn't enough to get your logins.
Giving OpenAI's dots your passwords? Ask who's typing them, not who's reading them.
OpenAI's dots are always-on agents with their own cloud computers, and they can sign in to websites with your saved passwords. Keeping a password from the model is a real protection. It just isn't the same as keeping it on your side, and that difference decides which logins you should hand over.
Can Google read its new private AI memory?
Google wants Gemini to remember you across devices, in the cloud, in a store it says even Google can't open. We read the technical brief to find where the key is when your data is readable.
What a leaky Twitch extension says about your other extensions
A Twitch extension read your login token and sent it to a russian bot service's proxy servers, where it sat in cleartext in the logs. It stopped only after researchers made it public.
What the Credential Exchange Protocol actually fixes
Passwords could always leave a password manager as a plaintext file. Passkeys can't — there's no string to copy. That gap is why Apple, Google, Microsoft and the major password managers agreed on the Credential Exchange Protocol, and it's a useful lens for what any manager's "export" actually promises you.
Infostealers took 1.
Infostealers took 1.7 billion credentials from 7.4 million machines in six months. No password manager stops malware already running as you — but where your vault lives decides how much one infection is worth, and whether someone else's bad year can add to it.
What happens when a password manager's servers go down
Your vault being encrypted and your vault being reachable are two different promises. A short login incident this week is a clean way to see why, and what to check about the tool you use
What “zero-knowledge encryption” actually promises
Zero-knowledge encryption is a promise about one opponent: the company holding your vault. Four cryptographers spent a year testing whether four password managers were keeping it.
Clickjacking steals passwords. Here's how Vauz stops it.
Researchers showed that one invisible click can drain a password manager's autofill. Vauz 1.4.2 answers with an approval prompt the page cannot draw over — Touch ID, or your V-Key.
Privacy shouldn't be a setting
Privacy already feels boring because everyone ignores it. It should feel boring because it is on by default, not buried in a settings menu.
How Vauz keeps your secrets local
On-device design changes more than storage—it changes who has to earn your trust.