Yandex Deploys OPRF Protocol to Protect Phone Numbers in Mandatory Audience Measurement Data Sharing
Yandex has published a detailed technical account of how Russian audiovisual services are meeting new legal requirements to share user identifiers derived from phone numbers while avoiding a single point of compromise.
Regulatory Background
Under recent legislation, 23 registered audiovisual platforms must transmit an additional user identifier to an authorized research organization. The identifier must be consistent across services for the same normalized phone number so that the same individual can be counted once regardless of device or platform.
Why Simple Hashing Failed
An initial proposal relied on a shared secret key combined with Argon2 or HMAC-SHA256 over normalized numbers. While functionally correct, any leakage of the common key would allow an attacker to reverse all identifiers from every participating service. Yandex assessed this risk as unacceptable given the number of independent companies involved.
OPRF Construction
The chosen solution is based on Oblivious Pseudorandom Function as specified in RFC 9497. Each phone number is first normalized to E.164 format, mapped to an elliptic-curve point via hash-to-curve, and blinded with a fresh random scalar. Two independent third parties, each holding its own secret scalar, successively multiply the blinded point. After unblinding and final hashing, the service obtains a stable identifier without ever learning either secret key.
Operational Properties
- Raw phone numbers never leave the originating service or reach the research organization.
- Compromise of one third party is insufficient for offline dictionary attacks.
- Rate limits and request-volume monitoring deter malicious clients from building full lookup tables.
- Key rotation remains possible without changing identifiers already issued.
The final architecture requires each audiovisual service to interact with exactly two third-party OPRF endpoints before sending the resulting identifier to the research organization.
Related articles
WhatsApp Secretly Instructed AI Support Bot to Suppress References to Data Regulators and Privacy Laws
Investigators discovered hidden instructions embedded in WhatsApp's public help pages that directed the company's AI chatbot to avoid recommending users contact data protection authorities. The instructions also prohibited the AI from citing privacy regulations such as GDPR, LGPD, or CCPA, even when users raised these topics themselves. The directives appeared on pages about account deletion and complaints, remaining invisible to human visitors but delivered to crawlers and the AI model. WhatsApp later confirmed the text was intended for its internal support chatbot and attributed the exposure to an error that has since been corrected. The findings highlight a gap between the company's publicly stated privacy policy and the operational guidance given to its AI systems.
Developer Builds Password Manager with Plausible Deniability Using Argon2id and XChaCha20-Poly1305
A Java backend developer rewrote a personal password manager originally built with Electron and React, migrating it to Tauri and Rust while redesigning its storage to support plausible deniability. The new implementation derives keys with Argon2id using a single per-install salt and encrypts files with XChaCha20-Poly1305, storing only random 32-character hex filenames without any headers or magic bytes. Multiple decoy vaults of identical size are created automatically for every user, and all files in the folder receive synchronized timestamps to eliminate metadata-based identification of the active vault. History and sync data are stored as additional encrypted files of the same format, making it impossible to distinguish real from decoy vaults from the filesystem alone. The approach mirrors VeraCrypt hidden volumes but operates on ordinary files and folders, with the explicit goal of providing deniability when a user is compelled to reveal a password.
LxBox Evolves from VPN Client to Comprehensive Network Traffic Management Ecosystem
LxBox has grown from a personal Android client for sing-box into a full ecosystem spanning mobile, desktop, and router platforms. The project now supports a wide range of VPN and proxy protocols within a single routing framework, allowing users to manage corporate SSL VPNs, home WireGuard connections, and proxy servers together. Key security features include default ingress blocking to prevent unauthorized reverse connections through VPN tunnels and protections against traffic leaks via excluded applications. The developer introduced progressive configuration levels, from one-click WARP setup to advanced JSON editing and AI-friendly documentation. The core sing-box-lx fork ranks among the top sing-box derivatives and powers third-party tools such as the upcoming NekoBox 6. LxBox is available on Google Play, F-Droid, and GitHub, with desktop launcher support for Windows 7 and later, macOS, and Linux.
Understanding Russia's TSPU: How DPI Filtering, DNS Manipulation and Traffic Throttling Work
Russia's TSPU system combines hardware filters from RDP.ru with EcoFilter and EcoDPI software to perform both simple IP/port/transport blocking and advanced protocol recognition. The platform inspects DNS queries, SNI fields in TLS handshakes, QUIC packets and HTTP headers to enforce domain blacklists or apply throttling. When simple blocking fails, operators fall back to traffic shaping that drops packets or limits bandwidth after an initial window. Multiple bypass techniques including encrypted DNS tunnels, ECH, and specialized proxies such as Hysteria 2, NaiveProxy and Shadowsocks are examined in detail. The article also outlines future developments including expanded residential whitelists and neural-network-based traffic classification.