Red Hot Cyber

Cybersecurity is about sharing. Recognize the risk, combat it, share your experiences, and encourage others to do better than you.
Search

A joke extension and Chat Control crashes! Houston, we have a problem… with privacy

Sergio Corpettini : 30 September 2025 07:49

In 2025, the European Union wants full control over private chats. The “Chat Control” regulation (proposal COM(2022)209) claims to fight child pornography by scanning private messages on WhatsApp, Telegram, Gmail, and the like. Noble intention in theory. In practice, it means every single message you type online could be read and analyzed by automated systems, with very real and immediate consequences for everyone’s privacy. And since no system is unbreakable, it doesn’t take a genius to do the math on the risks.

For the average user, the fallout is simple but serious:

  • Every message becomes potentially visible to an algorithm that judges and categorizes it.
  • Platforms will be forced to roll out scanning tools, with errors and false positives that can lead to bans or suspensions for no good reason.
  • Trust in private chats collapses – nothing is really “just between you and the other person” anymore.

Meanwhile, the people who actually want to hide aren’t shy neighbors – they’re criminals, pedophiles, terrorists, and political extremists, all more than happy to use custom crypto and obscure channels. Chat Control won’t catch them. Instead, it’ll hammer ordinary citizens while the real bad guys walk free. It’ll open backdoors and vulnerabilities ripe for exploitation by anyone with the right mix of skills and motivation.

The result? A clumsy, expensive, ineffective system that actually endangers billions of users.

The Illusion of Control

The official pitch is neat and tidy: force Big Tech to install automatic scanners everywhere. “No more secrets, no more abuse.” Catchy slogan. Too bad it doesn’t work. You can force a platform to add scanners, but you can’t stop two determined people from encrypting their messages on top of any service. Encryption isn’t an optional feature you can ban by decree.

As the Cypherpunks wrote back in 1993: “Privacy is necessary for an open society in the electronic age. We cannot expect governments, corporations, or other large organizations to grant us privacy out of their beneficence.”

Need a practical demo? Here it is: https://github.com/F00-Corp/Asocial

How I built an extension in one afternoon.

I fired up Cursor, refused to write code by hand, and in a few hours spat out a Chrome extension that encrypts and decrypts text anywhere: LinkedIn, Reddit, Gmail, Twitter.

It works like this:

  • You write a message in any text field.
  • Hit Ctrl+Shift+E and watch your message turn into an unreadable blob. Only someone with the right key can see it. Goodbye, European Big Brother.
  • The extension uses ECIES for key encapsulation with ephemeral per-message keys and AES-256-GCM for the payload. Keys and metadata stay local; exchange happens via JSON copy/paste.
  • Publish the blob anywhere: posts, comments, social media, whatever.
  • The recipient imports the key and reads the original, clean message.

From the platform’s perspective, it’s just random noise. Good luck “scanning” that. Not impossible to break, but suddenly a lot more expensive – even for anyone trying to exploit the inevitable backdoors and vulnerabilities this new control system will create.

Cypher Squatting: Owning the space, for free, with style.

 This isn’t just crypto, it’s strategy. Cypher squatting means using any available platform as a free channel for private messages. Posts, comments, bios, forum pastes, even blobs hidden in image metadata – anything the platform hosts without needing our own server. We don’t donate our thoughts, feelings, or words to whoever runs the platform. We lock them up mathematically and then toss them in the stream.

Why it works:

  • Platforms treat blobs as legitimate user content. Blocking them en masse would break entire services.
  • No extra infrastructure needed: use the platform’s own storage as a bridge.
  • It’s resilient: if one channel closes, use another. Free redundancy.

Not heroics – just digital self-defense. You claim what’s yours, lock it with math, and only then hand it over.

Why anyone can do this

  • Uses only standard WebCrypto APIs.
  • No central server required.
  • Key exchange is just copy/paste.
  • If you can press Ctrl+Shift+E, you can protect your chats. No NSA PhD required.

Europe? They can only watch. It’s free software, it’s math, and it’s infinitely replicable.As The Mentor wrote in the Hacker Manifesto: “This is our world now… the world of the electron and the switch, the beauty of the baud.” Systems like Chat Control? They’ll never win against a world that cannot be controlled.

Technical mini-panel (for non-techies):

  • Message encryption: ECIES (Elliptic Curve Integrated Encryption Scheme)
  • Ephemeral per-message keys for forward secrecy
  • AES-256-GCM for encryption + integrity
  • Key management: fully local
  • Key files encrypted with password via PBKDF2 + AES-256-GCM
  • Each key stored separately encrypted
  • Magic Codes: 7-character IDs for quick lookup
  • No network involved: everything happens on your machine

In short: ECIES + AES-GCM protect your messages, local storage keeps your keys safe, and each message uses a temporary key. Neither platforms nor governments can read without the right key. Warning: not a cheat code for invincibility.

The Elephant in the Room

For the EU to really stop this approach, they’d have to ban:

  • AES, RSA, Curve25519, and basically everything protecting VPNs, online payments, and communications.
  • The use of random-looking text on public networks (so goodbye HTTPS).

In other words, back to the 56k modem era – or outlaw electricity and independent thought altogether. Good luck with that.

The Moral

Chat Control was politically sold as “protecting the children.” Technically, it’s a joke: encryption is open source, reproducible, and impossible to erase. The real outcome is the nightmare activists have been warning about for years: insecure systems for billions of honest users, while the actual criminals – pedophiles, terrorists, extremists – keep doing their thing with basic technical tricks.

Or, in my case, with Ctrl+Shift+E and a bit of cypher squatting. Imagine what happens when people spend more than one afternoon on it.

As Morpheus said in The Matrix: “The Matrix is a system, Neo. That system is our enemy.” Chat Control is the same system.

What you should take away

Refusing to passively surrender your personal space is healthy. Privacy is not optional – it’s a fundamental human right. It’s the right to exist without labels, to express yourself without being categorized, indexed, or manipulated. Even the right to be nobody. That’s the informational self-determination we’re losing under confusing political narratives.

This proof-of-concept shows one simple thing: defending against invasive control tech is far easier than it looks. Practicing DATA HYGIENE online and offline is non-negotiable: any information you don’t want public should never exist in digital form. Ever.

If you’re curious, the extension repo is public on GitHub – clone it, expand it, hack your own ideas into it, and if you feel like it, tell me what you’re building. Call it a provocation, a research toy, or just a geeky distraction. I just wanted to share it.

Resist, encrypt, and make privacy a habit – not a theatrical extra.

Disclaimer: article reviewed and approved by L4wCyph3r to avoid misunderstandings

My Key:

{
  "name": "Rev-X-000 - Asocial-Publish",
  "privateKey": "MIGHAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBG0wawIBAQQgUEWKwTHz6RFObEwteDKq7zV1UFrSn+oPx9w23+6cJGyhRANCAASLPO0eZUeSm0jO78Y0lTrXF9StQRp/A7zvs8RTdlHndwq/74kHFOs9mfamB1lwf6/Zs6bAmv9BbfugMt2EXmwL",
  "magicCode": "O4GS484",
  "type": "reader",
  "exportedAt": "2025-09-28T19:40:05.050Z"
}

Can you read this?

[ASOCIAL O4GS484] eyJlcGhlbWVyYWxQdWJsaWNLZXkiOiJNRmt3RXdZSEtvWkl6ajBDQVFZSUtvWkl6ajBEQVFjRFFnQUV0eDJlaEs2WWtqMTM4eFBWQTVmb2d5VjgzQmtOOHpHcnJ5OUx2TlFXeHcwZTFNcXJpbUpWdno0OTdFcG5uRTFleUczT2U0dHJJT2lIK1libjVYVU9RUT09IiwiaXYiOiJQRjZubjJOWEtpYk0xcGYxIiwiZW5jcnlwdGVkRGF0YSI6IitXU2RTS3V6b0VHTVlCRGNSQWNVRXZEd1dDa0tUK1RvNERlMDZSa1RrSHhqQ2d6VTJObDVIaDltQlpWSzBoK3VrQTJCcFJJWkFwOU1HTS82Yno1YjVQbWsyeEtkbnNpOFZjYWtpRTArTWVsUlZoT1pYQnQrbHJYaUx0Vk9GbmU5bi9yY2RNT1pKczJxVnZzRmJyVGxqNzZlZEFyTlZkc0xnSHlERGEyNm5mSjF6QWRxam02QzlYVnQifQ==

Sergio Corpettini
Nomad with no fixed physical or digital abode, curious explorer of cyber and real recesses. High-functioning waffler. Occasionally knows what he is talking about but if you take him seriously he will be the first to mock you.

Lista degli articoli