Passwork, a Spain-based password manager used by EU government agencies and universities, turns out to be near identical to a Russian counterpart, same features, same manuals, just translated. Experts call it a state-level security risk sitting in plain sight.

Best bit: reporters found this just by comparing the publicly available user manuals side by side. No leak needed.occrp.org/en/investigation/european-password-manager-shares-origins-and-updates-with-state-certified-russian-firm

OCCRPEuropean Password Manager Shares Origins and Updates with State-Certified Russian FirmPasswork, a Spain-based password manager used by European government agencies and universities, shares technological ties with a Russian counterpart — an arrangement that experts say poses a state-level security risk.

Saw this doing the rounds this week. Open-source, single-image geolocation, claims to take a cropped, blurry photo with zero metadata and hand you coordinates within a few metres. New pipeline (MegaLoc for candidate retrieval, MASt3R for dense matching, spatial consensus to filter false positives) replacing a clunkier nine-stage setup.

Before anyone gets excited: this is one dev's repo, 213 stars, and every claim in the README is the author's own demo screenshots. No independent benchmarking against SIFT-based tools, no third-party accuracy figures, no peer review. "State of the art" and "world's most sophisticated" are the maker's words, not an outside evaluation.

The README itself flags the real limits worth taking seriously: it only finds what's already indexed, chain stores and identical apartment blocks still produce false positives at scale, and it needs real compute (a single city can be an overnight indexing job). Community-shared indexes also mean you're trusting someone else's pre-built dataset without knowing how it was assembled or verified.

Interesting architecture, worth watching. Not something I'd cite results from in a piece without testing it against a known location myself first. If anyone here runs it, curious to hear real-world hit rates rather than the highlight reel.

https://github.com/sparkyniner/Netryx-Astra-V2-Geolocation-Tool

GitHubGitHub - sparkyniner/Netryx-Astra-V2-Geolocation-Tool: The world's most sophisticated street level image geolocation softwareThe world's most sophisticated street level image geolocation software - sparkyniner/Netryx-Astra-V2-Geolocation-Tool

Delighted you're here, thanks for joining. The Hub is only a few hours old, so feel free to send the link to anyone you think would get something out of it, colleagues, contacts, whoever. More people in here just means better conversations for everyone.

Derek

The Signal, Issue #004: Patriot Front pays for itself.

Kicking off this channel with a resource rather than a single article: the OSINT Source Index, a running catalogue of institutional and open-source repositories built for exactly this kind of work.

It's organised by domain rather than by headline, so it's more useful as a reference to keep open while you're working a case than as a one-time read. Worth bookmarking if you haven't already.

Beyond that, this channel is for whatever you're reading that made you stop and think, whether that's a long investigation, a methodology writeup, or a single paragraph buried in something otherwise unremarkable. Drop the link and a line on why it caught your eye.

Starting this channel with a technique worth having in your kit: shadow-based chronolocation.

When a piece of UGC has no timestamp but shows a clear cast shadow, you can narrow the capture time using the sun's position at that location and date. The core inputs:

• Latitude and longitude of the scene (from geolocation)

• The date, if known or estimated

• Shadow direction and, ideally, an object of known height to estimate shadow length

Feed those into a solar position calculator and you get a plausible time window, sometimes narrow enough to cross-reference against other sourcing.

Limitations worth flagging: cloud cover, indirect light, and uncertain object height all widen your margin of error. Treat the output as a range to test, not a confirmed timestamp.

What's in your verification kit? Drop tools, dorks, or techniques here as you find them.

Welcome to the OSINT Hub.

This is Signal & Shadow's practitioner space: a place to trade tradecraft, verify claims, and work through investigations together, between issues rather than just inside them.

A few ways to get started:

• Drop a line about what you work on and what you're chasing at the moment

• Post a tool, dork, or dataset in Tools & Techniques

• Flag something worth reading in Interesting Reads

Shadow subscribers also have access to Shadow Desk for direct intelligence sharing and forensic Q&A.

Good to have you here.