Security research (https://xitter.cf/t.co/xrmvhFVPtv), EDM (https://xitter.cf/t.co/Ynq2DNWQa1), & board member @ Zcash Foundation.
Calgary, Canada
Joined February 2012
- Tweets20.7K
- Following1.4K
- Followers9.5K
- Likes9.3K
Taylor Hornby 🛡❤️ retweeted
This is fucking crazy.
I knew all the Smart TVs were spying—that’s why I have a commercial panel with minimal compute and no radio, plugged in to an AppleTV. But this is crazy!
Instead of drawing MIDI over your presets, draw presets over your MIDI. Life changing, thanks Claude.
Taylor Hornby 🛡❤️ retweeted
We owe you an apology.
On October 20, we detected unauthorized access to our official website. After verifying API activity with Shopify, we confirmed on October 23 that a third party obtained customer shipping information. You trusted us with those details, and we're sorry we didn't keep them safe.
Exposed: names, contact details, shipping addresses, and order details (items and prices).
Not exposed: payment card or bank details, recovery phrases, private keys, or wallet passwords.
We've blocked access, fixed the vulnerability, opened an investigation, and are emailing affected customers.
Scammers may pose as Keystone by phone, text, email, or mail, offering refunds, replacement devices, or "fixes" for your order or address. None of it is from us.
NEVER share your recovery phrase or private keys, and NEVER enter your recovery phrase into a device you didn't order. We will never ask for them. Don't click links in unexpected messages. Type keyst.one yourself.
A detailed report is coming soon.
Until then, trust only our official channels. If anything feels off, email [email protected]. We'd rather hear from you than have you take a chance.
Again, we're truly sorry to everyone affected.
Taylor Hornby 🛡❤️ retweeted
The models were always going to be open. They’re now open. So the question is: in the six months of non-openness, did Glasswing and Daybreak access fix enough bugs? I don’t think there’s one answer to that question, but I also don’t think the answer is obviously “yes”.
btw, i think dario was right about the cyber risks of proliferating these models freely on the internet, but wrong about how access should be distributed.
looking back at this tweet, glasswing was directionally the right approach, except it remained a walled garden for a select few. openai got this part right by giving broader access to legitimate security researchers.
Taylor Hornby 🛡❤️ retweeted
Is there a way to tell a model something like:
----BEGIN NO COMPACTION ZONE----
this never gets summarized or deleted
----END NO COMPACTION ZONE----
Taylor Hornby 🛡❤️ retweeted
We've been building software on top of human written slop this whole time.
Taylor Hornby 🛡❤️ retweeted
Some stats on #php2shell. In the 10 hours before it was publicly announced, across the @Cloudflare network we saw thousands of attempts to exploit it. That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within 2 hours, and millions now.
Taylor Hornby 🛡❤️ retweeted
This is the first time I've ever seen a site do this, the obvious simple response to a disclosure of a vulnerability without a fix: sacrifice availability to preserve safety. This option should be why we do full disclosure.
Taylor Hornby 🛡❤️ retweeted
Yesterday the Zcash Foundation board named me Executive Director. Thank you to Alex for steady leadership through a tumultuous stretch, and to everyone who has reached out this week.
The job as I see it has two halves: 1) keep the infrastructure fast, secure, and boring. 2) make privacy something ordinary people use without having to think about it.
I don’t think privacy is a feature, and I don’t think it’s a niche. It’s the room a society needs to think, speak, associate, and change its mind. Any system people depend on for daily life should give them that room by default. That’s the standard I’ll hold our work to.
Taylor Hornby 🛡❤️ retweeted
Big milestone for Shielded Labs: the activation height for NU7 is being set today! The upgrade includes our first major mainnet deployment: the Network Sustainability Mechanism (NSM).
Like Bitcoin, Zcash faces a long-term challenge: how to sustain network security as block rewards decline. The NSM helps address that while preserving the 21 million coin cap.
ZIP-235 removes 60% of transaction fees from circulation, allowing that ZEC to be reissued as future block rewards. ZIP-237 starts that recycling around February 2031.
At current fee levels, that’s only about 210 ZEC per year. This is a modest first step, but we’re optimistic about how new use cases for the NSM could evolve over time and contribute to Zcash’s long-term security.
Taylor Hornby 🛡❤️ retweeted
The Zcash Foundation Board of Directors has appointed David Campbell as Executive Director.
Thank you, Alex Bornstein, for leading with a constant focus on bringing the Zcash ecosystem together. Welcome, David, a longtime member of this community.
zfnd.org/zcash-foundation-na…
Taylor Hornby 🛡❤️ retweeted
Think about the chain of human decisions that’s involved in upgrading a big network full of hardware devices made by different vendors. Now think about how accessing that same network looks from the offensive side right now. It’s not even close to symmetrical.
Taylor Hornby 🛡❤️ retweeted
CLAUDE FOUND THE SEEDS
anthropic.com/research/ecdsa…
Taylor Hornby 🛡❤️ retweeted
shielded pools *do not* provide high levels of privacy if you use them as a pass through
"pass through" means you move funds into a pool and then withdraw them quickly after
shielded pools provide privacy if you hold funds at rest over a long period of time
Ledger theft, day two. Since yesterday the thief has pushed ether through Tornado Cash three times, and each time on into Zcash's shielded pool. We followed every lot out the far side. Here is how, step by step.
1. THE SAME BUILD, THREE TIMES
An ether wallet pays a fresh splitter. The splitter pays four fresh wallets. The four drop it into Tornado Cash's 100, 10 and 1 ETH pools. Minutes, every time.
Run 1, yesterday 15:17: 1,254 ETH. Run 2, today 09:42: 1,291 ETH. Run 3, today 11:56: 450 ETH from 0xfa4EaBB840A33C156E600311433AE261CBfCb0e2, in the pools by 12:15.
2. OUT OF TORNADO CASH
The mixer breaks the link between a deposit and a withdrawal. We do not need the link. Our tooling fingerprints the withdrawal transactions themselves: how each one is constructed, who constructs it, and when.
Yesterday's 65 withdrawals (1,084 ETH) and today's 96 (1,726 ETH) all carry the same signature. The six other withdrawals from those pools in today's windows do not. Run 3 came out from 12:18 into 0x0d697aa182801566d87adc86e68e95fd3b2f5f82 (213 ETH) and 0x676b16cc18542f37d202a1a79ac05463395496a4 (122 ETH), and 195 ETH of it was inside a cross-chain swap service by 12:38. Forty-two minutes, end to end.
3. INTO ZCASH, AND OUT AGAIN
The swap service turns the ether into shielded ZEC, where sender, amount and recipient vanish. But the service's own shielding of each lot is public, and from it we derive a value signature for that lot's exit, then scan every transparent exit from the pool. 108 of 108 exits across both days match their lot to the zatoshi. Not one other exit from the pool does.
First lot today: in at 10:18:18, out at 11:06:16 in block 3512847 (8d26a9b095d4d28373527f7a6eb81a3be7f906d1e2190960c0512ff64f369418 and 738c6d1261e79766e4dd16bdbd38dced91b8e3a86ce41dcda83eda1f19208fbf), straight into a ZEC to USDC order.
Today so far: 20 lots ordered (2,379 ZEC, $2.9m), 14 out, 5 inside the pool, 1 still settling. Every exit feeds a ZEC to USDC order paying two wallets born at 11:11, 22 of the 28 paid by 12:43:
0x816D5Ee17DB1495d1409F135b98FF3edc5F3cDf8: 940,561 USDC
0xBA736A4b616e79867B6d586293966b552883f3F3: 852,258 USDC
1.79m USDC, unspent. @Circle can freeze it.
(1/2) 🧵⤵️
I feel like the delta between human cryptanalysis and AI cryptanalysis will be greater for symmetric cryptography, no? Like an attack that actually breaks ECDLP would probably be comprehensible to humans but an attack that actually breaks AES probably wouldn't be.
Idc if you use AI in your music *but* if you do, it better be some other-wordly alien intelligence level shit
