We believe that open sourcing is an essential part of building trust

 around secure products. As a first step to completely open sourcing Skiff, we're sharing two key components of the Skiff codebase: our typed-AEAD envelope and UI component libraries.

As we scaled out our platform, it became important to be able to inspect metadata without having to decrypt objects. This would both save compute and prevent decryption of badly-formatted data.

Our authenticated encryption with associated data (AEAD) envelopes library allows us to embed additional information in the output of encryption functions. While the nacl family of envelope functions (e.g. secretbox) only support encryption-related metadata (e.g. nonces), our library is more extensible. We currently use our AEAD library at Skiff to validate data versions and types.

Skiff UI is a react components library for the Skiff UI Design System. It's currently in-use almost everywhere on our app. Over time we plan to continue adding more security and privacy-focused components to the library. Our hope is that Skiff UI will be able to spread usability to security products more widely.

The two libraries can be accessed at the following links: 

. We're releasing them under the GNU AGPLv3 license.

We look forward to having more eyes on our codebase, and appreciate any feedback. If you have any questions or ideas, feel free to reach out to us at hello@skiff.org.

—realizing our vision to build the application layer for Web3—private, decentralized, and end-to-end encrypted.


Decentralization and privacy defy major trends in the last decade of the internet: Centralization and abstraction. Websites, services, and collaboration platforms serve content, aggregate user data, and run computations via massive data centers and cloud providers. Decades of new algorithms grew around these anti-privacy computation models, from operational transformations (which aggregate and compose user input in real-time collaborative applications) to MapReduce (which permitted massive clusters to sequence and process inflows of user data). Today, when using most cloud services, individuals’ personal information is constantly sequenced and analyzed to support new features - such as predictive typing - and better advertisements.


Today, the world is different. Decentralized finance, storage, and identity upend these traditional models and offer a brighter, more private, and more personal future for computing. Decentralized data structures (such as CRDTs), algorithms, and storage platforms (more below!) present a new model wherein computation can be distributed among users of an application, and data stored without levels of abstraction or control by cloud providers.


Decentralization and privacy go hand-in-hand. While privacy demands that users know exactly how and when their personal data is shared, decentralization keeps users’ information outside of anti-private, centralized databases. End-to-end encryption and decentralization together truly deliver complete control over personal data to Skiff users. Technically and organizationally, decentralization helps us deliver on our core promise to users.
In this world, we see:
The predominant communication and computation model as peer-to-peer (p2p);


Identity as defined by an individual’s keypairs, which can be used for messaging, finance, collaboration, and more;


Users are able to benefit from services without sharing any data with service providers.


In this technical model, Skiff empower users with more control over their work, creativity, and personal information.


Your identity is your keypair. Skiff’s products keep your personal information private to you. Our whitepaper details this approach to provisioning users with keypairs (for encryption and attestation). Like a password manager or a crypto wallet, this technical design represents the foundation of decentralized collaboration.


Decentralized real-time collaboration via CRDTs. As detailed in our pre-launch blog post on decentralized collaboration from March 2021, decentralization allows us to realize numerous technical and user-friendly advantages. In particular, CRDTs enable us to, in real time, synchronize data structures across multiple Skiff users around the world. Users communicate end-to-end encrypted document changes to each other and arrive at fully synchronized, independent copies of working documents.


Decentralized storage via IPFS: We are incredibly excited to announce our collaboration with Protocol Labs and IPFS to build fully decentralized storage into Skiff. In IPFS, Filecoin, and libp2p (for direct peer-to-peer communication), Protocol Labs is building foundational infrastructure to enable decentralized, privacy-first applications like Skiff.


Now, Skiff users can store files, static content, and more via the Interplanetary Filesystem (IPFS). Inside the settings page, users can enable or disable IPFS storage.

Skiff, Decentralized

Skiff is thrilled to announce the release

 of a new option to log into Skiff with a MetaMask wallet. Tens of millions of individuals already browse the internet with an Ethereum address as a primary form of identity. Now, Skiff has joined the ecosystem of forward-looking services that offer them seamless access.

This integration is technically groundbreaking (see more below) and provides all Ethereum wallet-holders access to privacy-respecting, end-to-end encrypted, and decentralized collaboration. Internally, Skiff already functions a lot like a crypto wallet - safeguarding keypairs and other sensitive information for your documents, identity, and team. We’ve written about this in past blogs on 

. Using similar functionality in the MetaMask wallet (such as eth_decrypt), we’re able to automatically create a Skiff account directly from a user’s wallet.

, you’ll now see an option to “Login via MetaMask” on the 

 login page. If you don’t have the MetaMask extension, this button remains invisible.

Once you click “login via MetaMask,” you’ll immediately be prompted to sign a login token - an attestation that you own your Ethereum wallet. You will first have to authenticate with your MetaMask wallet using a password. 

As the final step, you’ll then be asked for your encryption public key, which is used to secure your Skiff login token and password. From there, the normal Skiff login process begins - choosing a theme (light or dark mode), setting a display name, and enabling account recovery. For your collaborators’ sake, we highly encourage setting up a display name!

That’s it! You’ll then have access to writing, collaboration, and sharing — all with your Ethereum wallet address.

Now that we’ve covered the wallet-based login process, let’s dive into how it works behind the scenes!

First off, if you have the Metamask extension installed, you will see the option to log in with your wallet. If you don’t, you’ll see the familiar email-password login.

When you connect to Skiff with a new Ethereum wallet, the first thing we ask you to do is to verify that it’s actually you. To do this, we generate a challenge message with your wallet address and a random string for you to 

. We call this challenge message skiffLoginToken, which you can see in the Metamask prompt. This 

 attacks and other impersonation strategies that could compromise your information’s security.

After verifying that this digital signature is valid, we can rest assured that you’re not being impersonated. At this point, Skiff’s 

 relies on private / public keypairs that are subsequently encrypted with your password, which is never stored or sent over any network. But since the whole point of logging in with our wallet was to eliminate site-specific passwords, we won’t ask you to create and remember a password. Instead, we randomly generate a password, ask you to 

, and then store the encrypted result (which can be decrypted with your MetaMask wallet) for future reference. Your unencrypted password 

 leaves your browser (so we can’t ever see it!) and only you hold the keys to unlock your encrypted password.

That’s it! Using only your Metamask wallet, you’re securely logged in and ready to start securely collaborating on Skiff!

When logging in with an Ethereum wallet that you’ve used before, the process looks a little different. To start, we will still ask you to verify your identity with the same challenge-response authentication. Next, you’ll retrieve your password so you can generate your private and public keys for accessing all your end-to-end encrypted data on Skiff. We query your encrypted password in our database and then 

. As with Skiff’s email-password login process, your plaintext password never leaves the browser, ensuring that everything you do on Skiff remains truly private.

The email address has been the internet’s default login credential for so long that it’s easy to lose sight of alternative (and often superior) approaches. With the emergence of Web3 and the continued decentralization of the internet, new forms of identity — such as an Ethereum wallet address or a unique encryption keypair — are already proving their advantages to both user autonomy and privacy.

Metamask logins are only a first step. Skiff is already developing new features to ensure that private, decentralized collaboration remains seamlessly accessible to as many people as possible, regardless of how they choose to access it.

Log in with Metamask

We’re excited to announce that Skiff Mail’s entire client code

 – including web, iOS, Android, and Desktop apps – will be completely open source at 

Starting today at launch, anyone will be able to check out the product codebase - understanding and ensuring how all data on Skiff Mail is completely end-to-end encrypted before ever leaving your device. We’ve also updated our 

 to provide a detailed overview of Skiff Mail’s technical architecture and underlying cryptographic protocols.

We have been committed to open source software since the very beginning of Skiff. We strongly believe that privacy cannot be just a promise; software must be available for anyone to independently audit and validate.

In addition to Skiff Mail, we’ve already open sourced our component library (

 Skiff as our ecosystem of products grows.

As developers, we love working closely with the open source community. You can join our 

 to submit questions, suggest contributions, or just share what you’re working on. We will also be regularly updating the 

 repo to stay in-sync with the live version of the app.

Skiff Mail is Open Source

: Privacy-first, end-to-end encrypted, open-source, Web3-native email.

Skiff Mail is built to be the next generation of email. Since the mid 1990s, email has brought an unprecedented degree of collaboration to the world - allowing scientists to share research, families to stay in touch, and the professional world to function.

Yet even as email has been adopted by billions of individuals, most large mail providers still have woeful privacy protections — allowing users’ messages to be read, processed, and stored by third parties.

Skiff Mail shifts the paradigm with simple and intuitive privacy. Skiff never stores unencrypted copies of any messages sent on Skiff Mail - and every Skiff-to-Skiff messages is end-to-end encrypted. Sign up, log in, and every message you send is owned by you.

Privacy applies beyond messages sent to and from Skiff Mail. Every message received from an external, third-party mail provider is immediately encrypted - ensuring only users have access to unencrypted copies of their emails.

Open-sourcing has always been a central piece of our strategy at Skiff, allowing us to build trust with our community and deliver transparent and trustworthy privacy. This is why we have decided to open-source the entire Skiff Mail product on launch. Visit 

Skiff Mail is also Web3 native. Sign up for Mail with a crypto wallet (currently MetaMask and soon Brave Wallet) to collaborate while completely owning your data. Just like Skiff's Workspace product, users have the option to store data on Protocol Labs' decentralized storage network IPFS, and also to send emails to/from their ENS addresses.

To use Skiff Mail, sign up for a Skiff account at 

Skiff Mail features instant, privacy-preserving search. Full text search has been a key feature in Skiff’s collaboration platform - allowing you to search through workspaces containing thousands of files instantly. We have brought this search function to Skiff Mail, allowing for message, subject, to/from/cc search, and more. Skiff’s search is completely open source - read more about Skiff search on 

Mobile and desktop apps for sending, receiving, and notifications are crucial for using email. Skiff Mail launches with fully featured mobile apps for iOS and Android as well as a fully featured macOS desktop app. Check them out below:

Skiff Mail lets you sign in, send, and receive mail using a crypto wallet. For the first time, send directly to an ENS address using Skiff. Read more about our wallet integration on Skiff’s 

Every Skiff Mail user receives 10 GB of free storage to send and receive mail and attachments. As we transition out of Skiff Mail Alpha into future versions, we’ll support additional storage and paid plans.

Introducing Skiff Mail

 “Encrypted Email Company Skiff Wants You To Sign Out Of Google Workspace Forever” announcing the launch of Skiff Calendar and Drive to the public.

In only one year, we’ve launched four products - 

 - and signed up over a quarter million people to our private, end-to-end encrypted email, collaboration, and communication products.

 for using Skiff products on your native devices.

We’re incredibly grateful to Skiff’s users, Pro subscribers, and Business users, as well as to our tens of thousands of community members across our 

Calendar and Drive Launch in Forbes

Encryption is used by almost every single application on the internet today. From data encryption inside databases, to network encryption used in SSL/TLS (every https: website), to end-to-end encryption inside secure messaging and communication products, a diversity of algorithms, encryption processes, and cryptography now power the modern web stack.

Below, we’ll define a few topics that are used throughout the blog.

: A type of encryption where the same key is used to encrypt and decrypt a message.

: A type of encryption where two different keys are used to encrypt and decrypt a message.

: A cryptographic function (“hash function”) that produces a fixed-size output (called a hash) from an input of any size. Hashes are commonly used to verify the integrity of data.

: A process of transforming data into a different format using a specific algorithm. Encoding is often used to convert data into a format that is more efficient for storage or transmission. It is not a form of encryption and does not provide any security benefits.

Encryption and decryption are important concepts in the field of computer science and information security. Encryption is the process of converting plain text (i.e. regular, readable text) into ciphertext (i.e. scrambled, unreadable text) using a mathematical algorithm and a secret key. Decryption is the reverse process of converting ciphertext back into plain text using the same algorithm and key.

Skiff-crypto library for easy encryption, decryption, and more

We at Skiff offer an end-to-end encrypted, privacy-first product suite with Mail, Calendar, Pages, and Drive products. Naturally, they use encryption in every part of the application to keep your emails, calendar events, notes, and files private and accessible only to you.

 to make cryptography even easier to use in JavaScript on Node.JS and in the browser. To use `skiff-crypto`, check out the short tutorial below:

const skiffCrypto = require('@skiff-org/skiff-crypto');

// or, `import * as skiffCrypto from '@skiff-org/skiff-crypto';`

const plaintext = "Hello from skiff-crypto!";
const keypair = skiffCrypto.generatePublicPrivateKeyPair();
const encrypted = skiffCrypto.stringEncryptAsymmetric(keypair.privateKey, { key:keypair.publicKey }, plaintext);

const decrypted = skiffCrypto.stringDecryptAsymmetric(keypair.privateKey, { key:keypair.publicKey }, encrypted);
console.log('Plaintext:', plaintext);

console.log('Ciphertext:', encrypted);
console.log('Expected to be true:', plaintext === decrypted);

The library offers many, many more functions, including signature verification functions - such as 

In Javascript, encryption and decryption are typically implemented using one of several popular algorithms, such as the Advanced Encryption Standard (AES) or the RSA algorithm. The specific algorithm used depends on the needs of the application and the security requirements of the data being encrypted.

To illustrate how encryption and decryption work in Javascript, let's consider a simple example using the AES algorithm. In this example, we will use a secret key of "12345" and a plain text message of "Hello, world!"

First, we need to import the necessary libraries for AES encryption. In this case, we will use the "crypto-js" library, which can be installed into project dependencies using the following NPM command:

Note that if you prefer to use yarn, the command “yarn add crypto-js” will work as well. Once the library is installed, we can import it into our Javascript code using the following line of code:

Next, we need to define our secret key and plain text message. In this example, we will use the key and message defined earlier:

const key = "12345";
const plainText = "Hello, world!";

With the key and plain text defined, we can now encrypt the message using the AES algorithm and the CryptoJS encrypt function. In Javascript, this is done using the following code:

const encrypted = CryptoJS.AES.encrypt(plainText, key);

The encrypted message is returned as a ciphertext string, which is unreadable to anyone who does not have the secret key. For example, the encrypted text in this case might look something like this:

U2FsdGVkX18cwq3S7v2bT+E9T9XkTfH4D4Gp+gWZFok=

To decrypt the ciphertext back into the original plain text message, we can use the following decryption function:

const decrypted = CryptoJS.AES.decrypt(encrypted, key);

This line uses the encrypted ciphertext and the secret key to decrypt the message back into its original plain text (“Hello, world!”). In some cases, encryption or decryption functions expect certain encodings of text, such as hex or utf8, which each use different character sets to represent data.

AES encryption, which is used here, is a symmetric encryptionalgorithm where the same secret key is used to both encrypt and decrypt the text.

In asymmetric encryption, different keys are used to encrypt plain text (a public key) and decrypt the cipher text (private key).

Node.js is a runtime environment for executing JavaScript code on the server side. Node.js includes a built-in library called crypto that provides a number of cryptographic functions, including functions for generating hashes, signing and verifying digital signatures, and generating random numbers.

The Web Cryptography API, or WebCrypto, is a JavaScript API that provides similar cryptographic functionality to the crypto library in Node.js. WebCrypto is designed to be used in web applications and allows developers to perform cryptographic operations directly in the browser. This can be useful for implementing security features such as password hashing and encrypting sensitive data without having to send the data to a server for processing.

Both the crypto library in Node.js and the WebCrypto API provide a powerful set of tools for implementing cryptographic functions in web applications. However, it is important to use these tools carefully and securely to ensure that sensitive information is protected.

Encryption is used in web applications to protect sensitive information such as passwords, credit card numbers, and other personal information from being intercepted and read by unauthorized individuals. When a user submits sensitive information to a web application, the information is encrypted by the web application before it is transmitted over the internet. This ensures that even if the information is intercepted by a third party, it will be unreadable and unable to be used. Encrypting sensitive information is an important security measure that helps to keep user information safe and secure.

Examples of apps that use encryption in the web

MetaMask is a browser extension that allows users to interact with the Ethereum blockchain from their web browser. MetaMask uses encryption to protect the sensitive information that is stored in the user's wallet.

When a user creates a wallet with MetaMask, they are required to choose a password. This password is used to encrypt the user's private keys, which are stored locally on the user's device. This means that the user's private keys are unreadable without the password and are therefore protected from unauthorized access.

1Password is a password manager that helps users securely store and manage their online passwords. 1Password uses encryption to protect the sensitive information that is stored in its password vault. When a user creates an account with 1Password, they are required to choose a master password. This master password is used to encrypt the user's password vault, which means that the information stored in the vault is unreadable without the master password.

1Password uses a combination of symmetric and asymmetric encryption to protect user information. When a user first creates their account and sets their master password, 1Password generates a unique encryption key that is used to encrypt the user's password vault. This encryption key is then encrypted using the user's master password and stored on 1Password's servers.

When a user logs in to 1Password and enters their master password, 1Password uses the encrypted encryption key to decrypt the user's password vault. The user's master password is never sent to 1Password's servers and is only used locally on the user's device to decrypt the encrypted encryption key. This means that 1Password is able to protect user information without ever having access to the user's master password.

Skiff Mail, Calendar, Pages, and Drive (email and productivity suite)

Skiff is a privacy-first, end-to-end encrypted email and collaboration suite with mail, calendar, collaborative notes, and file storage products. All data on Skiff - messages, files, notes, and calendar events - is end-to-end encrypted, meaning only you have access to your data. When logging into Skiff, your device decrypts data into a human readable form.

, with paid plans available as well. Similar to MetaMask and 1Password, a password is used to encrypt private information when you sign in. This password also enables you to transfer and decrypt data on another device, while keeping that data end-to-end encrypted.

Skiff is one of the best examples of a user-friendly, intuitive application that uses cryptography inside the browser and in Javascript.

We hope this blog was helpful! For more information, checkout Skiff’s 

. We’ll be sharing further tutorials on how to perform asymmetric encryption in javascript as well.

How do encryption and decryption work in Javascript?

In this blog, we’ll cover the best privacy apps on Android. From browsers to email applications, privacy is a critical need in online software today. Protect your communications, internet use, collaboration, and other personal data that is typically bought and sold across the internet. We’ll also cover some great Android security tips, such as using 2FA on your services and keeping your Android version up to date.

These tips are intended to be simple and easy to follow, and every piece of software mentioned is widely used, respected, and trusted by the privacy community. Read on for more!

Privacy-focused web browsers have been downloaded and used by hundreds of millions of Android users. From additional security features, such as phishing protection, to tracker blocking, a privacy-focused web browser is a must for anyone looking to ramp up privacy protections on their Android phone.


with over 10 million downloads to date. In addition to a minimalist design and high speed browsing, Firefox Focus advertises a built-in ad blocker and website tracker protection - basic privacy features that all private web browsers on this list offer. Note that Firefox Focus is also open-source, another trust-building feature for security and privacy apps.

: Brave Browser on Android is another very popular privacy-focused web browser, with over 100 million downloads. In addition to blocking trackers and increasing security, Brave supports in-app firewall, VPN (Virtual Private Network), and crypto wallet functionality, giving it key additional security features you may typically find in a separate security app. Brave also is supposedly planning to introduce Tor browsing to the mobile app for a truly private, decentralized browsing experience; however, this feature does not exist yet today.

: DuckDuckGo is quite a popular search engine and web browser on Android. Beyond tracker protection and private search, DuckDuckGo offers an email proxying service wherein emails sent to your address are instead routed through DuckDuckGo, ideally stripping the emails of trackers and sending privately to your inbox. We highly recommend using this service alongside Skiff Mail, which proxies or blocks remote content to ensure total privacy.

DuckDuckGo’s Android app also advertises app privacy protection wherein network requests from other apps (Twitter, Facebook, etc.) are routed through DuckDuckGo for increased privacy.

For a private email and calendar solution, we highly recommend using 

, which offer web, Android, and iOS apps. Skiff products include numerous security features and settings, such as:

End-to-end encryption of all sensitive data

 offers end-to-end encryption of email subjects and content, which means that only you and recipients can access message content. Email providers and everyone else, including Skiff, cannot access this data. Gmail, Microsoft Outlook, Hotmail, and other email services do not offer end-to-end encryption.

: Skiff proxies all remote content by default, keeping your device information, IP address, and operating system free from spyware. You can also block 

: Setting up 2FA is a natural choice for anyone security-inclined. On Skiff, this ensures that you enter in a one-time password before signing in to your account.

: Skiff offers password protection for documents, files, and PDFs, as well as watermarks for any notes and documents created on Skiff. This adds additional security and protection to your work. Skiff’s Pages product allows for real-time collaboration and notes to be shared internally or externally.

Below, we’ll share more on Skiff paid plans, which offer even more storage, custom email domains, and features for families, teams, and companies. To sign up, visit 

Private messaging apps today offer significantly greater online privacy protections than traditional SMS messages. From end-to-end encryption to private voice and video calls, we strongly recommend using one of the choices below as a secure replacement for text messages. Many Android users are also migrating from Android Messenger or WhatsApp to the options below as they offer better metadata privacy.

: Signal is one of the host highly regarded secure messaging products in the world. From full end-to-end encryption with forward secrecy and almost no metadata collection to video and calling capabilities, Signal is a wonderful choice for communicating effectively while maintaining good mobile security.

, with over 100 million downloads to date. The company also offers an Android APK that can be directly installed on mobile devices, which is helpful for users who are not using the Play store or who have 

: Session is another popular end-to-end encrypted messenger that collects no metadata or personal data and uses a decentralized architecture to send private messages. Unlike Signal, Session does not even require a phone number to sign up and send messages.

 with over a million downloads. The product also allows you to create group chats, send voice messages, and share files or attachments.

Using Skiff for private email, calendar, notes, and file storage

Skiff’s privacy-first ecosystem of Mail, Calendar, Pages, and Drive products offers an entire suite for leveling up your digital security. If you’re using an Android device for work, you may consider onboarding your entire team to Skiff’s product suite, including a custom domain for email, aliases for different departments, and shared teams or drives.

For more on paid plans, check out the table below on numerous additional features for you, your family, or your company.

Replace your big tech work suite with Skiff

Skiff enables using a full workspace for all communication and collaboration. 

In addition to Skiff Mail, which is covered above, Skiff offers three additional end-to-end encrypted apps

 enables real-time collaboration and creating an end-to-end encrypted 

for teams, wikis, job boards, and notes. You can also enable decentralized storage on the InterPlanetary Filesystem as well.

—Skiff Drive is a full Google Drive, Box, or Dropbox solution with end-to-end encryption of all document data and titles. Files can also be stored on IPFS with end-to-end encryption, enabling access to your encrypted data outside of Skiff.

—Skiff Calendar end-to-end encrypts your calendar event titles, external attendees, notes, video conferencing details and more, keeping your schedule and activity private to you.

For more information on Skiff products, check out the 

We hope the tips above helped you find more privacy-first alternatives for communicating and browsing the web. Ultimately, there are great products that work well, have great user interfaces, and protect user privacy at all costs.

If you’re looking for more guides, we also wrote a blog on the best end-to-end encrypted 

 on the best iOS, iPhone, and Mac security and privacy practices.

What are the best Android privacy apps?

Phishing protection is a security measure designed to protect individuals and organizations from phishing attacks. Phishing is a type of online scam in which an attacker poses as a legitimate entity (such as a bank, government agency, or well-known company) in order to trick the victim into giving away sensitive information, such as passwords, login credentials, or financial information.

There are several different types of phishing protection available, including:

Email filters: These scan incoming emails for known phishing patterns and block or flag suspicious messages.

Web filters: These block access to known phishing websites or redirect users to a warning page if they try to access one.

Anti-phishing software: This type of software is installed on a device and helps to protect against phishing attacks by analyzing web pages and emails for suspicious content.

Training and education: This can involve teaching individuals how to recognize and avoid phishing attacks, as well as providing them with resources and protection solutions to reduce risk.

Overall, phishing protection is an important aspect of online security, as it can help to protect individuals and organizations from falling victim to these types of scams.

How can you protect against phishing attacks?

There are several steps you can take to protect yourself and your organization against phishing attacks:

Be cautious of emails and websites that ask for sensitive information: Be wary of emails and websites that ask for sensitive information, such as login credentials, financial information, or personal details. If you receive a suspicious email or visit a malicious website, do not click on any links or enter any information.

Use anti-phishing software: Install anti-phishing software on your devices to help protect against phishing attacks. This software analyzes web pages and emails for malicious content and can block access to known phishing websites or flag potentially malicious messages.

Use strong, unique passwords: Use strong, unique passwords for all of your accounts, and consider using a password manager to help you generate and store them securely.

Enable two-factor authentication: Two-factor authentication (2FA) adds an extra layer of security by requiring you to enter a code in addition to your password when logging in. This code is typically sent to your phone or email, so even if someone else has your password, they will not be able to log in without access to your phone or email.

Keep your software and devices up to date: Make sure to keep all of your software and devices up to date with the latest security patches and updates. This can help to protect against known vulnerabilities that could be exploited by attackers.

Educate yourself and others: Learn about phishing attacks and how to recognize and avoid them. Share this information with your colleagues and encourage them to be cautious as well.

By following these steps, you can help to protect yourself and your organization against phishing attacks and other online threats.

Phishing is a type of online scam in which an attacker poses as a legitimate entity in order to trick the victim into giving away sensitive information, such as passwords, login credentials, or financial information. Here are some of the most common phishing techniques:

: This involves sending a fake email that appears to be from a legitimate source, such as a bank, government agency, or well-known company. The malicious email may contain a link or attachment that, when clicked, downloads malware onto the victim's device or directs them to a fake website where they are asked to enter sensitive information.

: This is a targeted form of phishing that involves sending a personalized email to a specific individual or group, often with the aim of tricking them into divulging sensitive information or access to an organization's systems.

: This involves sending a fake text message that appears to be from a legitimate source, such as a bank or government agency. The text message may contain a link or phone number that, when clicked or called, leads the victim to a fake website or phone line where they are asked to enter sensitive information.

: This involves an attacker posing as a legitimate representative over the phone and asking the victim to disclose sensitive information.

By being aware of these common phishing techniques and knowing how to recognize and avoid them, you can protect yourself and your organization from falling victim to these types of scams. Here are a couple more detailed examples:

An attacker sends an email claiming to be from a well-known bank, stating that the recipient's account has been compromised and requesting that they click on a link to reset their password. The link actually leads to a fake website where the victim is prompted to enter their login credentials and financial information, which the attacker then uses to access the victim's account and steal their money or credit card number.

A scammer purchases a domain name and creates a fake website spoofing the login page of a popular social media app. They then send emails to a large number of users, claiming that their account has been compromised and directing them to log in to the fake website in order to reset their password. When the victim enters their login credentials on the fake website, the attacker is able to use them to gain access to the victim's sensitive data. This could lead to identity theft, bank account compromise, credit card theft, or impersonation of the victim.

Social engineering attacks refer to the use of psychological manipulation and persuasion to influence individuals to take actions that may not be in their best interest. In the context of phishing, attackers use social engineering tactics to create a sense of urgency or fear in the victim, making them more likely to take the bait and fall for the scam.

One common tactic used in phishing attacks is the creation of fake websites or emails that look legitimate, but are actually designed to steal personal information or install malware on the victim's device. These fake sites or emails may be made to look like they are from a legitimate company, government agency, or financial institution, and may contain logos and branding that appear authentic.

Another tactic used in phishing attacks is the creation of fake social media profiles or online profiles on dating or job websites. These profiles are used to build trust with the victim and gather personal information or persuade them to click on malicious links.

In addition to these tactics, hackers and phishers may also use pretexting, which involves creating a fake identity or situation to obtain sensitive information from the victim. This may involve pretending to be a co-worker or supervisor, a customer service representative, or a member of a trusted organization.

Overall, social engineering is a powerful tool that is often used in phishing messages to manipulate and deceive victims into divulging sensitive information or taking actions that they would not normally take. It is important to be aware of these tactics and to remain vigilant in protecting personal information online.

Ransomware is a type of malicious software that encrypts a victim's files, making them inaccessible until a ransom is paid to the attackers. Ransomware attacks can be financially devastating for businesses, as they can disrupt operations and lead to financial losses. To protect your data from ransomware, it is important to take the following precautions:

: This way, if your files are encrypted by ransomware, you will have a copy that you can restore.

Keep your operating system and antivirus software up to date

: This will help protect your computer from new threats.

Be cautious when opening email attachments or clicking on links in emails

: Ransomware is often delivered through malicious email content, including attachments and links. Do not open attachments or click on links from unfamiliar sources.

Avoid downloading software from untrustworthy websites

: Be sure to download software only from reputable sources.

: A firewall can help block incoming connections that may be malicious.

: Macros can be used to deliver ransomware. Disabling macros in office documents can help prevent this type of attack.

Ransomware can be some of the nastiest cybersecurity risks as hackers may charge millions of dollars for recovery. The tips above can protect you from these attacks.

If you believe that you have received a phishing email or have encountered a phishing campaign, there are several steps you can take to report it:

: Most email providers have a dedicated email address for reporting phishing scams. You can typically find this address by searching online or by contacting your email provider's customer support. Forward the suspicious email to this address to report it. Gmail and Apple products have spam filters and such functionality built in to their email clients.

Report the website to the Federal Trade Commission (FTC)

: If you have encountered a phishing website, you can report it to the FTC by visiting their website (

Skiff is Open Sourcing

Typed-AEAD Envelopes

Skiff UI

Getting Involved

Related articles

Join the community