IT | Website Builders and more. Hardened Matrix Tor Server - https://teapaw.org/t.co/YjBxwrz5UQ E2EE Everywhere 🇵🇦
Global
Joined August 2022
- Tweets2.6K
- Following510
- Followers355
- Likes5.7K
Pinned Tweet
——— 🔒Ephemere Chat🔒 ———
We are introducing a streamlined, zero-knowledge onboarding flow for our self-hosted Matrix Tor/clearnet server.
To eliminate any identity at the point of entry, paid accounts now require zero contact information. We recommend Monero (XMR) for transactions to ensure maximum payment anonymity; registration tokens (valid for 24h) are delivered directly via the browser.
To facilitate environment evaluation while maintaining sybil resistance, a 2 MONTH FREE TRIAL is available via anonymous contact, providing full access to all system features.
The infrastructure is engineered for absolute ephemerality and deterministic data erasure:
- Data Retention: 12h custom redaction script (covering all messages, media, emojis, and stickers) and ~36h native retention supplemented by a bi-weekly FULL Postgres vacuum for complete physical disk reclamation.
- Identity Management: Weekly automated device removal, strict session limiting (max 2 devices) with automated pruning and E2EE key/secret storage key purging every 30mins.
- Infrastructure: Security-hardened environment hosted on dedicated physical hardware with full-disk LUKS encryption, zero IP logging, no message recovery, and access via Tor/clearnet routed through encrypted tunnels.
Access here for Free Trial & Paid: Ephemere.chat/pricing
Stop leaving a messaging trail - No Record. No Risk. No Trace.
Engineered for high-risk coordination, dissident groups, and those who cannot afford a digital paper trail.
Most "private" messaging apps still track your identity and store all your metadata. We’ve built a space for communities that cannot afford to leave a trail.
- Zero Identity: Anonymous registration. No phone numbers, no emails.
- Closed Loop: Non-federated. Your data never leaves our hardware and temporarily exists.
- Blind Relay: Mandatory E2EE ensures only you and your recipients hold the keys. The server simply moves the data; it can never read it.
- Auto-Purge: 12h content redaction; 36h total wipe of all messages and metadata.
- Total Cleanup: When your project is finished, notify the admin and they will deactivate and purge all community accounts to leave zero trace.
- Verifiable Proof: Use our Verification Panel to audit Ed25519 signatures of our redaction logs and live server state. Verify it yourself locally using OpenSSL. Don’t trust us? Verify it on your computer. Access here: ephemere.chat/#ed-3880889065
In a world of permanent records, we provide a Matrix server instance (Tor & Clearnet) that forgets very quickly.
If you need a space for high-stakes coordination, or just want to exist off-the-grid, we have a few community slots open.
Reach out for an invite community registration token, or contact us anonymously at: ephemere.chat/#ed-3880888867
38
S.A.P retweeted
#OPSEC365 236/365
Messaging apps harvest phone numbers from your contacts to build user databases.
When Signal, WhatsApp, or Telegram checks which of your contacts use the service, they're uploading phone numbers to their servers. Even if your contacts never joined, their numbers exist in the platform's database because you uploaded your address book.
Every contact you upload gives that platform the phone number of someone who never agreed to be in their database.
#OPSEC365
S.A.P retweeted
New Fingerprinting Tests!
I'm excited to announce a major addition to PrivacyTests.org: we have developed two dozen new fingerprinting resistance tests to obtain an objective head-to-head comparison of how different browsers protect you against fingerprinting.
Our results show that no browser has perfect fingerprinting defenses. The strongest protections are seen in LibreWolf, Mullvad Browser, and Tor Browser, but every browser has room for improvement!
Fingerprinting is a common method that online trackers use to uniquely identify your computer and track you invisibly as you browse the web. Browsers can protect you against fingerprinting, but the current level of protection varies greatly between browsers.
Our fingerprinting resistance tests, currently run on desktop browsers, are organized in two sections: Device tests and Settings tests.
The "Device" tests measure whether your browser is leaking detailed information about your computer hardware. Fingerprintable properties of your computer that we measure include audio processing, GPU, memory, CPU cores, math processing, chip architecture, and OS version.
The "Settings" tests measure whether system settings are leaking through your browser. Fingerprintable settings that we measure include screen resolution, system toolbar dimensions, display preferences, keyboard layout, timezone location, and user-installed fonts.
Traditionally, services such as CoverYourTracks.eff.org, fingerprint.com, and amiunique.org survey a population of browser visitors and analyze the uniqueness of your browser's fingerprint.
PrivacyTests.org's fingerprinting tests take a different, complementary approach across browsers. These tests directly measure whether each browser is leaking characteristics of the computer it is running on.
For example, to check if the number of CPU cores is leaked, our test runs the same browser on virtual machines with different numbers of CPU cores and asks: does the browser spoof or randomize the value? If so, the browser passes the test (✅)! If, instead, it leaks the true value, then the browser has failed the test (❌)!
We apply this approach to many system settings and device properties that are commonly used by tracking scripts to fingerprint your computer.
The fingerprinting test results shown here are part of the larger context of browser privacy protections reflected in our many other categories of privacy test results, all presented at PrivacyTests.org.
We hope these fingerprinting test results are useful to everyone looking to switch to a browser that respects and protects their privacy. We also hope they are galvanizing to any browser engineering team working to improve their browser's privacy.
We'll keep testing over time! ✅❌
It’s looking like monero:native is going to take over from zcash:native the way it’s going.
The upgrade to ZEC didn’t really achieve much from a price perspective.
73
We have extended the data retention window from 24 to 36 hours to address synchronisation edge cases and ensure total reliability.
The previous 24-hour TTL (Time-to-Live) would sometimes result in "zombie messages" and prevent redactions from reaching clients before the data was purged from the server.
By extending the retention window to 36-hours, the server retains the redaction commands long enough to deliver it to the client upon reconnection, ensuring the message redaction hits at 12-hour TTL, rather than waiting for the next scheduled reset. This serves as an additional layer of protection, while our forced weekly device logouts continue to ensure a comprehensive purge of the client cache, maintaining our strict commitment to user privacy and security, both client and server side.
An example would be: when our automated script triggers a redaction while a user is offline, the server must hold that instruction until the user reconnects. If the user stays offline for 25 hours after sending a message, the old 24-hour window would purge the redaction instruction before the user opens the app, leaving the message in their local cache.
The now 36-hour retention window ensures the redaction command has sufficient time to deliver.
While this is a minor adjustment, we are committed to maintaining the highest standards of system reliability, privacy and performance.
Explore the upgraded ‘Verification Panel’ for full transparency, now optimised with integrated tooltips ℹ️ to streamline your understanding: ephemere.chat/#ed-3880889065
37
We have built a simple live browser privacy comparison widget. It aggregates live real-time test results from ✅privacytests(.)org, the open-source project that rigorously audits browser privacy and security.
Instead of trusting marketing claims, see exactly which browsers pass state partitioning, tracking query parameter stripping, fingerprinting resistance and HTTPS enforcement tests - across desktop, mobile and private modes.
Filter by the categories that matter most to you and sort top rated, least rated, or alphabetical to find your match instantly. The tool normalises results to account for platform-specific feature availability, ensuring fair comparisons.
Data pulled is live as privacytests(.)org publishes updates, so rankings reflect the current browser landscape.
Choose your browser based on evidence, not hype.
Access here: Ephemere.chat/browsertests
S.A.P retweeted
Today’s browser update (v1.99.56) contains a fix for a Chromium vulnerability found to be exploited in the wild.
You may have received the automatic Brave update already. If not, you can manually update by visiting ‘About Brave’ from the browser’s ☰ menu.
The Android update is waiting on Google Play Store review and should be out shortly.
Pour nos utilisateurs Android en France 🇫🇷 confrontés à des restrictions réseau : vous pouvez maintenir votre connectivité via la passerelle Tor. En utilisant Orbot pour router votre trafic via le réseau Tor et votre client Matrix @matrixdotorg pour vous connecter à notre serveur Matrix Tor via notre adresse .onion, vous garantissez que vos communications restent anonymes et résistantes à la censure.
Ce bouclier technique est renforcé par notre cadre juridique ; comme indiqué dans nos CGU, Ephemere est régi par les lois du Panama, offrant ainsi une couche de protection juridictionnelle robuste à nos utilisateurs.
Accéder ici: Ephemere.chat
For our Android users in France 🇫🇷 encountering network restrictions: you can maintain connectivity via the Tor pathway. By leveraging Orbot to route your traffic through the Tor network and using your Matrix @matrixdotorg client to connect to our Tor Matrix server via our .onion address, you ensure your communications remain anonymous and censorship-resistant.
This technical shield is reinforced by our legal framework; as stated in our TOS, Ephemere is governed by the laws of Panama, providing a robust jurisdictional layer of protection for our users.
Access here: Ephemere.chat
37
Onboard via our anonymous payment rails in the next 24 hours to receive an extended 6-month trial, instead of the standard 2-month free offer. New subscribers only.
Access via the Free Trial option:
Ephemere.chat/pricing
36
We are making cryptographic transparency more accessible.
We recently integrated tooltips ℹ️ across our Ed25519 Verification Panel to provide instant documentation on each line of the cryptographic proof, reducing friction for users auditing the data.
Access here: ephemere.chat/#ed-3880889065
27
WhatsApp @WhatsApp applies end-to-end encryption to message content, but the metadata surrounding each message remains accessible to the provider.
Per its privacy policy, WhatsApp intentionally collects and can process the following:
⚠️Account identifiers: phone number and profileinformation
⚠️Communication metadata: contact graph,message timing, and frequency
⚠️Device and network telemetry: device model,OS version, app version, IP address, and mobile network details
⚠️Contact graph ingestion: phone numbers from the device address book, stored in hashed form, when contact syncing is enabled
⚠️Group metadata: group names, membership lists, and membership timestamps
⛔️Location data: transmitted only when the user explicitly shares it
⛔️Cloud backups (iCloud or Google Drive) are not end-to-end encrypted by default, so their contents are outside the E2EE guarantee unless end-to-end encrypted backups are explicitly enabled.
WhatsApp doesn't publish a fixed retention period for message metadata. Its privacy policy says - their wording
WhatsApp Privacy Policy:
"Information that we process to convey your messages or calls (which includes information like your phone number, the time and date you make a call or send a message, or the duration of your calls) is subject to and handled in accordance with the specific rules and requirements under the EU Directive 2002/58/EC, where applicable."
WhatsApp Privacy Policy:
"We store information for as long as necessary for the purposes identified in this Privacy Policy, including to provide our Services, or for other legitimate purposes, such as complying with legal obligations, enforcing and preventing violations of our Terms, to fight spam, or protecting or defending our rights, property and users."
————————
Matrix @matrixdotorg on the other hand is a communication protocol that supports both federated and standalone deployment architectures.
Registration requirements, such as email and phone verification, are optional and determined by the server operator's configuration.
In our case - zero contact requirements, all system data is fully transparent and verifiable via our integrated verification panel, complemented by independent validation through your Matrix client.
Tiered access is available via Free and paid options:
1️⃣The Free tier necessitates an anonymous contact point exclusively for registration token distribution.
2️⃣Paid accounts are provisioned with zero contact requirements and support anonymous payments through Monero.
Access here:
Ephemere.chat
50
Matrix @matrixdotorg is a sophisticated, often underutilised alternative to WhatsApp, offering mostly full feature parity while prioritising user sovereignty.
End-to-end encryption (E2EE) for all communications
Comprehensive rich media support, including files, images, video, stickers, and GIFs
Integrated voice messaging
Message pinning for high-visibility access to critical information
Interactive collaboration tools: reactions, polls, and checklists
Encrypted local data storage
Seamless desktop integration and notifications
Real-time location sharing
Biometric app locking and customisable themes
All these capabilities are available via our highly secure, non-federated, self-hosted Matrix instance.
Access here: Ephemere.chat
57
The recently updated verification panel renders an expanded telemetry set, integrating parameters parsed from the YAML configuration alongside operational and security metrics: maintenance and offline gap detection, LUKS disk encryption status, and confirmation that no external IPs are logged.
The page refreshes automatically every 60 seconds. Behind it, three signed data feeds arrive from the homeserver on staggered schedules: live counts every minute, server status every 15 minutes, and redaction receipts every 30 minutes.
If any feed goes quiet beyond its freshness window - 3 minutes for counts, 20 for status, 60 for redaction - it is flagged as stale by name.
All records are delivered via an Ed25519-signed pipeline, with a badge reflecting live verification results. To remove any need to trust the web servers rendering, a "Verify It Yourself" section lets visitors download the signed records and public key to validate the entire chain locally with OpenSSL, making the dashboard tamper-evident and independently verifiable end to end.
Access here:
ephemere.chat/#ed-3880889065
46
S.A.P retweeted
The dark forest isn't a metaphor anymore. It's an automated, low-latency meat grinder.
Attackers used to get tired. They had to parse Git history, triage database dumps, craft calldata, and evaluate targets manually.
Now? Continuous autonomous agent pipelines:
- Claude code dumps plaintext root creds to public GitHub -> automated scrapers rotate and drain your cloud before the commit email even hits your inbox.
- Web3Auth infrastructure cracks -> automated scripts hit wallet endpoints across 19 chains, draining millions while users are literally asleep.
- Mass magic-link spamming -> scripts bombard exposed emails from recent leaks, waiting for one tired user to tap an auth button.
When machines hunt at zero marginal cost 24/7, every convenience layer is an execution path. Social logins, centralized relays, cloud secret sync, agent-assisted dev tools—all liabilities.
Staying paranoid is the only defensive strategy left:
1. Cold keys that never touch a network controller.
2. Zero-telemetry hardware with verified boot re-locking.
3. Radical data minimization on every single endpoint.
The hunters don't sleep.
Take your attack surface off their grid, build your own bunker.
Web3Auth raised tens of millions preaching “non-custodial MPC” and “users own their keys.”
Today’s reality: a vulnerability hits their backend, and Web3Auth runs a script that sweeps $3M across 19 chains without a single signature confirmation from any user device.
Read that again, slowly.
If a company can drain your balance while you’re asleep and tweet “relax guys, that was our whitehat sweeper bot front-running the hacker,” you never had a self-custodial wallet. You had a centralized database with a Web3 splash screen and an OAuth middleman.
The entire “seedless onboarding” narrative was just a VC cartel selling Web2 convenience at the cost of giving a random node cluster full spend authority over your stack.
You didn’t kill the middleman. You just gave him root access.
