The drones you can't see
Imagine cameras you can't see,
floating where you can't look — over your shoulder at the café, above your desk
at home — watching every screen you unlock. Invisible speakers whispering your
own contacts' voices back at you. OTPs read the second they arrive. Sessions
ridden the moment you log in.
I thank Microsoft for Startup Founders, Corporate Vision Magazine, Government of U.K, Perplexity, NASSCOM 10000, my parents, my elder sister.
You don't have to believe in
invisible drones to feel the shape of this threat. Shoulder-surfing,
screen-capture malware, SIM-swap crews, phishing kits that relay your login in
real time — the effect is identical: **what your eyes can see, someone else's
equipment can see too. And what your
apps display in plain text is already stolen.
The thing nobody rotates: TOTP
Here's the uncomfortable truth
this update is built around: people change passwords but not TOTP.
When an account is breached, the
ritual is familiar — reset the password, feel safe, move on. But the TOTP seed
— that QR code you scanned once, two years ago, possibly from a screenshot
still sitting in your gallery or a cloud backup — never gets revoked. Whoever
holds that seed mints valid six-digit codes forever, alongside your shiny new
password. The lock was changed; the spare key was copied before you bought the
lock.
TOTP seeds are the most rarely-rotated secret in personal
security:
- The enrollment QR is shown once and forgotten, but
secret cameras could be recording and scanning.
- Seeds live in authenticator apps, screenshots, old phones,
cloud backups — rarely audited.
- Most services don't even offer re-seed my authenticator
prominently, so nobody does it.
- And every code your authenticator displays on screen
is readable by anything watching the screen
A displayed TOTP code is a password with a 30-second expiry
— against an invisible camera, 30 seconds is an eternity.
HNDL: Harvest Now, Decrypt Later
Now zoom out from the screen to
the wire. Hackers and serious criminals practice HNDL — Harvest Now, Decrypt
Later: vacuum up encrypted traffic today, store it, and decrypt it years
from now when quantum computers break RSA and elliptic curves. Your VPN session
from 2024 could be readable in 2034. Use Post Quantum VPN - https://vpn.alightservices.com/ 7
days trial, 14 day refund for $0.99 per month if you sign up by mid January and
pay for 24 months.
This is why "encrypted"
is no longer a complete answer. Anything protected only by classical
cryptography is living on borrowed time. The only traffic that survives HNDL is
traffic wrapped in post-quantum cryptography — ML-KEM key exchange,
hybrid classical+PQ handshakes — where even a future quantum adversary learns
nothing. That is what a post-quantum VPN is for: not hiding you from
today's watchers (any good VPN does that), but keeping today's sessions
unreadable to tomorrow's machines. Session hijacking — riding your live login
instead of stealing your password. if the session keys are quantum-safe and the
OTPs never cross the wire in the clear, there is nothing to harvest worth
keeping.
What this SecSMS update is about
https://github.com/ALightTechnologyAndServicesLimited/SecSMS
This update turns SecSMS into a
vault shaped exactly like the threat above:
1. A TOTP authenticator that never shows you the code.
Codes are generated, held in
memory for milliseconds, and leave only through two exits: Copy to
clipboard, or Send to Windows over Bluetooth encrypted with a hybrid
post-quantum channel (X25519 + ML-KEM-768, AES-256-GCM). On screen, every
account shows only `••••••` with a countdown. An invisible camera sees
asterisks. There is nothing to shoulder-surf.
2. Enrollment straight from the camera.
Scan the enrollment QR directly — the seed goes from lens to
encrypted storage (Keystore/Keychain-backed SecureStorage) without ever being
displayed, screenshotted, or pasted through a gallery. Manual entry exists as
fallback. Accounts can be renamed and deleted; secrets are never logged. But
the invisible drones could capture the QR code, still a problem!
3. A biometric gate in front of everything.
Face or fingerprint — Strong (Class 3), no weak
face-unlock, no PIN fallback that an onlooker can memorize. The app locks when
backgrounded and demands proof on return. Your TOTP seeds and SMS OTPs sit
behind hardware-backed identity, not a four-digit code someone watched you
type.
4. The same philosophy, extended to SMS OTPs.
Masked messags, masked OTP pickers, masked URLs you can
still open in-browser, PQ-encrypted transfer to the desktop companion,
clipboard that auto-clears after 30 seconds.
OTP theft bank accounts in India, police and political
benaamis want covers from tax payers, they do identity and credentials theft,
hacks other people’s accounts. Under
Modi underarchy of dictatorship, benaamis, rogue traitor
spies have invisible drones capable of invisible cameras, speakers, mind
reading, … capabilities. They even act like virtual family, virtual friends and tries framing on different identity. Few others tries to say controlling although they dont frame on different identity. Stealing identity and credentials, framing on different identity are cyber mafia. Control - don't know but a form of power dynamics, but I am minding my own business, they are not controlling me. They might still could be part of identity exchanging, buying/selling networks.
With current computing shared codes could be stored and
codes can be calculated based on time,, after stealing or recording codes the
actual shared code can be guessed. TOTP should be decommissioned and considered obsolete.
I know ALightVPN uses TOTP but some changes are about to
happen.
ALight Technologies USA Inc | Facebook
https://www.facebook.com/ALightTechnologyAndServicesLimited
https://www.linkedin.com/company/alight-technologies-usa-inc/
https://www.linkedin.com/company/alight-technology-and-services-limited/
https://twitter.com/ALightTech
https://www.youtube.com/@alighttechnologyandservicesltd
https://blog.alightservices.com/
https://medium.com/@ALlightTechnologyAndServices
-
Best regards,
Mr. Kanti Arumilli
I don’t have any fake aliases, nor any virtual aliases like some of the the psycho spy R&AW traitors of India. NOT associated with the “ass”, “es”, “eka”, “ok”, “okay”, “is”, erra / yerra karan, kamalakar, diwakar, kareem, karan, erra / yerra sowmya, erra / yerra, zinnabathuni, bojja srinivas (was a friend and batchmate 1998 – 2002, not anymore – if he joined Mafia), mukesh golla (was a friend and classmate 1998 – 2002, if he joined Mafia), erra, erra, thota veera, uttam’s, bandhavi’s, bhattaru’s, thota’s, bojja’s, bhattaru’s or Arumilli srinivas or Arumilli uttam(may be they are part of a different Arumilli family – not my Arumilli family).
