Digital Sovereignty Glossary: 70 Terms Every Free-Thinking Person Should Know

Somewhere between the moment you agreed to terms and conditions you never read and the moment a company you’ve never heard of sold your location data to an insurance underwriter, a vocabulary formed that you were never taught. Not because it’s secret. Because learning it wasn’t urgent — until it was.

Digital sovereignty is the capacity to control your own data, devices, identity, and communications. That control begins with language. If you don’t know what a threat model is, you can’t build one. If you don’t understand metadata, you can’t protect it. If you’ve never heard of rubber-hose cryptanalysis, you’re already miscalculating your risk.

This is the complete reference. Bookmark it. Share it. Use it before you need it.

A

Adversarial Machine Learning

The practice of manipulating AI systems by feeding them specially crafted inputs designed to cause misclassification, data leakage, or model failure. A classic example: adding barely visible pixel noise to an image that causes a computer vision system to misidentify a stop sign as a speed limit sign. Relevant for anyone relying on AI-based security tools, since those tools can be fooled in ways that traditional software cannot.

Airgap

A physical isolation strategy in which a device or network is completely disconnected from the internet and all external networks, including wireless. An airgapped computer can only be compromised by someone with physical access or through a covert channel such as acoustic signals, heat, or electromagnetic emissions. Used by intelligence agencies, nuclear facilities, and serious privacy practitioners for storing the most sensitive data.

Anonymization

The process of removing or transforming personally identifying information from a dataset so that individuals cannot be re-identified. True anonymization is technically difficult — most “anonymized” datasets can be re-identified by combining them with other public data. Pseudonymization (replacing identifiers with pseudonyms) is weaker and reversible; genuine anonymization should be irreversible.

Attack Surface

The total set of points where an attacker could attempt to gain unauthorized access to a system. A laptop with ten apps installed has a smaller attack surface than one with fifty. Reducing attack surface is a core principle of digital hygiene: fewer apps, fewer open ports, fewer accounts, fewer permissions all shrink the area an adversary needs to exploit.

B

Behavioral Biometrics

Authentication and identification methods based on patterns of behavior rather than physical traits. How fast you type, the pressure you apply to a touchscreen, your mouse movement patterns, and your scrolling rhythm can all be used to identify or continuously authenticate you without a password prompt. Banks increasingly use behavioral biometrics invisibly in the background to detect account takeover fraud.

Browser Fingerprinting

A tracking technique that identifies a specific browser — and by extension, a specific user — by collecting a combination of characteristics: screen resolution, installed fonts, time zone, canvas rendering output, and dozens of other attributes. Unlike cookies, fingerprints cannot be deleted. Even with a VPN, a distinctive browser fingerprint can link sessions and defeat anonymization attempts.

Burner Device

A prepaid or disposable device purchased with cash and used for a specific, limited purpose before being discarded or reset. In operational security contexts, a burner device is used to prevent an activity from being linked back to your primary identity or your regular devices. Effectiveness depends entirely on never connecting the burner to accounts, networks, or behaviors tied to your real identity.

C

Canary Warrant

A legal mechanism used by service providers to signal that they have received a secret government order, such as a National Security Letter, without directly violating a gag order. The provider publishes a statement confirming no warrant has been received; when that statement disappears, users infer a warrant arrived. Absence is the signal. The legal status of canary warrants is contested in some jurisdictions.

Cold Wallet

A cryptocurrency storage method in which private keys are kept completely offline, on hardware devices or paper, and never exposed to an internet-connected system during normal use. Cold wallets are immune to remote hacking because there is no network connection to exploit. The tradeoff is that transactions require deliberate physical steps, and loss of the physical device or seed phrase typically means permanent loss of funds.

Cryptographic Hash

A mathematical function that converts any input — a file, a password, a document — into a fixed-length string of characters called a digest. The same input always produces the same hash, but it is computationally infeasible to reverse the process or find two different inputs that produce the same hash. Hashes are used to verify file integrity, store passwords without storing the passwords themselves, and ensure data hasn’t been tampered with.

Custodial vs. Non-Custodial

In the context of cryptocurrency and digital identity, custodial means a third party holds your private keys or credentials on your behalf — just as a bank holds your money. Non-custodial means you hold the keys yourself and are solely responsible for their security. Non-custodial arrangements maximize sovereignty but also maximize the consequences of your own mistakes: lose the key, lose the asset permanently.

D

Data Broker

A company that collects personal information from hundreds of sources — public records, purchase history, social media, location data, loyalty programs, and more — aggregates it into detailed profiles, and sells those profiles to marketers, insurers, employers, law enforcement, and anyone else willing to pay. You almost certainly have profiles at dozens of data brokers you have never interacted with. Most jurisdictions offer no meaningful opt-out mechanism.

Data Minimization

The principle of collecting only the data that is strictly necessary for a specified purpose, retaining it only as long as needed, and sharing it with as few parties as possible. Under GDPR and similar frameworks, data minimization is a legal requirement for organizations processing personal data. As a personal practice, it means resisting the impulse to fill out optional fields, use sign-in-with-Google, or grant app permissions that aren’t functionally required.

Dead Drop (Digital)

A communication technique in which two parties share information without directly exchanging messages, by leaving data in a location — a shared cloud folder, an email draft folder, an anonymous upload — that both can access. Because no message is transmitted, there is no message transmission record for an adversary to intercept. The technique, adapted from Cold War tradecraft, is used by journalists protecting sources and by activists in high-surveillance environments.

Decentralized Identity

A model of digital identity in which credentials and identifiers are controlled by the individual rather than by a central authority such as a government, corporation, or platform. Built on technologies like verifiable credentials and decentralized identifiers (DIDs), it allows you to prove facts about yourself — your age, your qualifications — without revealing unnecessary information or depending on an intermediary that can be revoked, suspended, or sold.

DLP (Data Loss Prevention)

A category of security tools and policies designed to detect and prevent sensitive data from leaving an organization’s control. DLP systems can block the upload of documents containing credit card numbers, flag emails with personally identifiable information, and prevent files from being copied to unauthorized external drives. In practice, DLP is a corporate tool, but the concept — knowing where your sensitive data is and preventing it from leaving — applies to personal security too.

DNS over HTTPS (DoH)

A protocol that encrypts Domain Name System queries, which translate domain names like theunhacked.com into IP addresses. Without DoH, your ISP, network administrator, or a passive observer on your network can see every domain you request, even if the content of your browsing is encrypted via HTTPS. Enabling DoH moves this metadata into an encrypted channel, reducing surveillance by network-level observers but shifting trust to your DoH provider.

E

End-to-End Encryption (E2EE)

A communication architecture in which messages are encrypted on the sender’s device and can only be decrypted on the recipient’s device. The service provider transmitting the message cannot read it, even under legal compulsion, because they never hold the keys. True end-to-end encryption requires that the provider not control key generation or storage. Verify any app’s E2EE claims against its technical documentation, not its marketing copy.

Exploit

A piece of code, a technique, or a sequence of actions that takes advantage of a software vulnerability to cause unintended behavior — typically gaining unauthorized access, executing arbitrary code, or escalating privileges. Exploits are the mechanism by which vulnerabilities become actual attacks. Zero-day exploits target vulnerabilities the software vendor doesn’t yet know about; N-day exploits target known vulnerabilities for which patches exist but haven’t been applied.

Exfiltration

The unauthorized transfer of data from a system to an attacker-controlled location. Exfiltration is typically the goal of a breach, not the breach itself — an attacker may spend weeks inside a network before extracting anything. The exfiltration phase is often the moment detection becomes possible, because unusual volumes of data leaving a network trigger anomalies. In personal security contexts, exfiltration risk is highest on devices with broad app permissions and cloud sync enabled.

F

FIDO2

An open authentication standard that enables passwordless login using hardware security keys or device-based biometrics. FIDO2 credentials are cryptographically bound to the specific website they were created for, making them immune to phishing — a phishing page cannot intercept a FIDO2 authentication because the credential won’t respond to an unrecognized origin. FIDO2 is the technical foundation underlying passkeys.

Forward Secrecy (Perfect Forward Secrecy)

A property of cryptographic key agreement systems in which session keys are generated freshly for each connection and are not derived from a long-term private key. The consequence: if an attacker records encrypted traffic today and later compromises the server’s long-term key, they still cannot decrypt the previously recorded sessions. Without forward secrecy, a single future key compromise retroactively decrypts all past traffic. The Signal protocol implements forward secrecy by design.

G

Geofence Warrant

A court order requiring a technology company — most commonly Google — to provide data on all devices present within a specific geographic area during a specific time window. Law enforcement uses geofence warrants to identify suspects by their location, often catching innocent bystanders who happened to be nearby. The practice raises serious Fourth Amendment questions in the United States and has been challenged in multiple jurisdictions.

GraphQL Injection

An attack technique targeting APIs that use the GraphQL query language, in which malicious inputs are crafted to extract unauthorized data, bypass access controls, or cause server-side errors that reveal system information. Analogous to SQL injection but tailored to the flexible, nested query structure of GraphQL. Relevant to anyone building or evaluating modern web applications that expose GraphQL endpoints.

H

Hardened OS

An operating system configured to minimize its attack surface through the removal of unnecessary services, enforcement of strict permission controls, application of security patches, and often the addition of mandatory access control frameworks. Examples include GrapheneOS for Android devices and Tails for anonymous desktop use. A hardened OS is not impenetrable, but it significantly raises the cost and complexity of a successful attack.

Honeypot

A decoy system, file, or credential placed deliberately to detect unauthorized access. If an attacker finds and uses a honeypot credential, security teams receive an alert with high confidence that a compromise has occurred — because no legitimate user would ever touch that credential. At the personal level, a honeypot can be as simple as a uniquely named email address used nowhere else; any email arriving at that address signals a data breach somewhere.

HSM (Hardware Security Module)

A dedicated physical device designed to generate, store, and manage cryptographic keys in tamper-resistant hardware. HSMs ensure that private keys never exist in software memory where they could be extracted by malware. Used in certificate authorities, payment systems, and high-security key management infrastructure. Consumer-grade equivalents include hardware security keys (YubiKey) and hardware cryptocurrency wallets.

I

IMSI Catcher (Stingray)

A surveillance device that impersonates a cell tower to intercept communications from nearby mobile phones. Phones connect to the strongest signal — the IMSI catcher provides one — allowing the operator to capture device identifiers, track locations, and in some configurations, intercept calls and messages. IMSI catchers are used by law enforcement and intelligence agencies; their use without a warrant has been challenged in courts across multiple countries.

Information Hazard (Infohazard)

Information whose dissemination poses a risk of harm — not because it’s false, but because it’s true and dangerous in the wrong hands. The term applies to everything from detailed synthesis routes for biological agents to specific vulnerability details published before patches are available. In personal security contexts, an infohazard might be a detailed travel itinerary, a document revealing the identity of a protected source, or security architecture details that make attacks easier to plan.

J

Jurisdiction Shopping

The deliberate selection of a company, service, or infrastructure provider based in a legal jurisdiction with favorable laws regarding data retention, surveillance, court orders, and user privacy. A VPN provider headquartered in the British Virgin Islands is subject to different legal obligations than one headquartered in the United States. Jurisdiction matters most when your adversary is a government, less so when your threat model centers on corporate data collection.

K

Key Escrow

A system in which copies of cryptographic keys are held by a trusted third party — typically a government authority or employer — who can retrieve them under defined conditions. Governments have periodically proposed mandatory key escrow as a mechanism for lawful access to encrypted communications. Privacy advocates argue that any escrow system creates a master key that, once compromised, undermines the security of everyone who depended on it.

L

Ledger

In the context of blockchain and cryptocurrency, a ledger is an immutable, distributed record of all transactions. Unlike a private bank’s internal records, a public blockchain ledger is visible to anyone and cannot be retroactively altered. The transparency that makes blockchains auditable also makes them surveillance-hostile for privacy: every transaction between addresses is permanently public, and address clustering techniques can often link wallets to identities.

Lawful Intercept

The legal mechanism by which telecommunications providers are required to give law enforcement agencies access to communications data under a valid court order. Most jurisdictions require telecom providers and internet service providers to build intercept capabilities into their infrastructure. Services that implement genuine end-to-end encryption can technically comply with a legal intercept order — handing over encrypted data — without providing readable communications.

Local-First Software

An architectural approach to software in which data is stored on the user’s own device and processed locally, with cloud synchronization as an optional feature rather than a requirement. Local-first software works offline, gives the user direct ownership of their data, and does not create a central server that can be hacked, subpoenaed, or shut down. The approach trades the convenience of always-available cloud sync for control, privacy, and resilience.

M

Metadata

Data about data. The content of a phone call may be encrypted, but metadata reveals who called whom, when, for how long, and from what location. A document’s content may be private, but its metadata can reveal the author, creation date, revision history, and the software used to create it. Former NSA Director Michael Hayden stated plainly: “We kill people based on metadata.” If you are protecting content but not metadata, you are protecting the wrong thing.

MFA Fatigue

An attack technique that exploits multi-factor authentication systems by sending an overwhelming number of authentication push notifications to a target’s phone until they approve one out of exhaustion, confusion, or the mistaken belief that a legitimate process triggered the request. MFA fatigue attacks have compromised major organizations including Uber and Cisco. The defense is switching from push-based MFA to FIDO2 hardware keys or number-matching prompts that require active confirmation of a specific code.

Mutual TLS (mTLS)

An extension of Transport Layer Security in which both the client and the server authenticate each other using digital certificates, rather than only the server proving its identity to the client. Mutual TLS is used to secure machine-to-machine communications in microservices architectures and API environments, ensuring that only authorized clients can connect to a service regardless of network position. It is a core component of zero-trust network architectures.

N

Network Segmentation

The division of a computer network into isolated subnetworks, so that a compromise in one segment cannot automatically spread to others. A home network practice is placing IoT devices — smart bulbs, thermostats, cameras — on a separate guest network, so that a compromised bulb cannot communicate with your laptop or NAS. In enterprise environments, segmentation limits the blast radius of a breach and contains lateral movement by attackers.

No-Log Policy

A commitment by a service provider — most commonly a VPN provider — not to retain records of user activity, connection times, IP addresses, or traffic. A no-log policy is only as good as the provider’s technical architecture and their willingness to be audited. Providers that have been served with legal orders and genuinely had no logs to hand over provide the most credible proof of their claims. Marketing assertions alone are not evidence.

O

OPSEC (Operational Security)

Originally a military concept, OPSEC is the discipline of identifying critical information, analyzing threats and vulnerabilities to that information, and taking countermeasures to prevent adversaries from obtaining it. In personal security practice, OPSEC means asking: what information, if known by an adversary, would harm me? And: what behaviors or patterns am I exhibiting that could reveal that information? OPSEC is a process, not a product — it fails the moment it becomes a one-time checklist.

OSINT (Open-Source Intelligence)

The collection and analysis of information from publicly available sources: social media, public records, news articles, company filings, satellite imagery, and more. OSINT is used by journalists, investigators, security researchers, and adversaries alike. The personal implication: information you consider private may be reconstructible from public sources by anyone motivated to look. Searching your own name and accounts through an OSINT lens is a useful exercise in understanding your own exposure.

P

Passkey

A FIDO2-based authentication credential that replaces passwords for website and app logins. Passkeys are generated as cryptographic key pairs: the private key stays on your device, the public key is stored by the service. Authentication happens locally using biometrics or a device PIN, and the credential is cryptographically bound to the specific site it was created for, making phishing attacks structurally impossible. Passkeys are synchronized across devices via iCloud Keychain, Google Password Manager, or compatible third-party managers.

Password Manager

An application that generates, stores, and fills strong, unique passwords for every account you use, protected by a single master password or biometric. Using the same password across sites means one breach compromises everything. A password manager makes credential reuse unnecessary and practical — it removes the cognitive burden that causes people to reuse passwords in the first place. Choose a manager with end-to-end encryption and a published audit record.

Plausible Deniability

The ability to credibly deny knowledge of or participation in something because there is insufficient evidence to prove involvement. In cryptography, plausible deniability refers to encryption systems — such as VeraCrypt hidden volumes — that produce an outer encrypted volume and a hidden inner volume, each opened with different passwords. Under coercion, you can reveal the outer password and its contents without revealing that a hidden volume exists.

Privacy by Design

An approach to system and product design in which privacy protection is built into the architecture from the start, rather than added as a compliance layer afterward. The concept, formalized by Ann Cavoukian, includes principles such as data minimization, purpose limitation, full functionality without privacy trade-offs, and end-to-end security by default. Privacy by Design is now codified as a legal requirement under GDPR Article 25.

Pseudonymity

The practice of operating under a consistent identity that is not your legal name, allowing accountability within a community or platform while maintaining separation from your real-world identity. Pseudonymity is not anonymity: a pseudonymous identity can be linked back to you through metadata, behavioral patterns, writing style, or account associations. The privacy value of pseudonymity depends entirely on how carefully the separation between the pseudonym and your real identity is maintained.

Q

Quantum-Safe Cryptography (Post-Quantum Cryptography)

Cryptographic algorithms designed to resist attacks from quantum computers, which can break widely deployed public-key cryptographic systems such as RSA and elliptic curve cryptography using algorithms like Shor’s. NIST finalized its first set of post-quantum cryptographic standards in 2024. The urgency: adversaries may be harvesting encrypted data today with the intention of decrypting it when quantum computers become capable enough — a strategy known as “harvest now, decrypt later.”

R

Right to Be Forgotten (Right to Erasure)

A legal right, established under GDPR Article 17, that allows individuals to request that organizations delete their personal data under certain conditions — when the data is no longer necessary for its original purpose, when consent is withdrawn, or when the data was processed unlawfully. The right is not absolute: it can be overridden by public interest, legal obligations, or freedom of expression considerations. Most non-EU jurisdictions provide weaker or no equivalent protections.

Rubber-Hose Cryptanalysis

A dark humor term from security culture referring to the extraction of cryptographic keys or passwords through physical coercion rather than through mathematical attack. The term is a reminder that even perfect cryptographic implementation cannot protect against an adversary with physical access to the person holding the keys. Mitigations include plausible deniability systems, duress PINs that trigger device wipes, and legal frameworks requiring procedural safeguards before coercive interrogation.

S

SAST and DAST

Static Application Security Testing (SAST) analyzes source code for vulnerabilities without executing it; Dynamic Application Security Testing (DAST) tests running applications from the outside, simulating attacker behavior. Both are used in secure software development to identify issues before deployment. SAST catches code-level flaws like injection vulnerabilities early in development; DAST catches configuration issues and runtime vulnerabilities that only manifest in a live environment.

Secure Element

A tamper-resistant hardware component on a device — typically a dedicated chip or a protected zone within a processor — that stores cryptographic keys and performs cryptographic operations in isolation from the main operating system. Your phone’s Face ID or fingerprint data lives in a secure element. Hardware wallets use secure elements to ensure private keys are never exposed to software. The secure element is the hardware anchor of modern device security architectures.

Self-Custody

Direct personal control over cryptographic private keys, without delegating that control to an exchange, custodian, or service provider. “Not your keys, not your coins” is the maxim in cryptocurrency circles: if you hold assets on an exchange and the exchange collapses, is hacked, or freezes withdrawals, you have no recourse. Self-custody requires responsibility for key backup and physical security but eliminates counterparty risk and third-party access to your assets.

SIEM (Security Information and Event Management)

A system that aggregates log data from across an organization’s infrastructure — servers, firewalls, applications, user activity — and analyzes it in real time for signs of attack, policy violation, or anomalous behavior. SIEMs are the intelligence layer of enterprise security operations centers. For individuals, the concept translates to monitoring login activity across key accounts and enabling notification alerts for unusual access patterns.

Signal Protocol

An open-source cryptographic protocol developed by Open Whisper Systems that provides end-to-end encryption with forward secrecy and deniability for messaging applications. The protocol is used in Signal, WhatsApp, and other applications. Its technical properties — including the Double Ratchet algorithm for key rotation — mean that even if a session key is compromised, past and future messages remain protected. The protocol’s code is publicly auditable, which is a substantive security advantage over proprietary alternatives.

Social Engineering

Manipulation of people rather than systems to gain unauthorized access to information or infrastructure. Techniques include phishing, pretexting (inventing a false scenario to extract information), baiting, and impersonation. Social engineering exploits human psychology — urgency, authority, helpfulness, fear — rather than technical vulnerabilities. Security training consistently shows that the human element is the most frequently compromised attack surface in any organization.

Stingray (see: IMSI Catcher)

A commercial brand name for an IMSI catcher that has become a genericized term for the entire class of cell-site simulator devices. Stingrays are used by law enforcement agencies worldwide, often without warrants and often with minimal public disclosure. The devices affect every phone in their range, not only surveillance targets, and have been documented in use at protests, political events, and public gatherings.

Supply Chain Attack

An attack that targets the software or hardware supply chain — a dependency, a build tool, a third-party library, an update mechanism — rather than the end target directly. The 2020 SolarWinds attack compromised a software update process and reached thousands of organizations including US government agencies. Open-source dependency compromises, in which malicious code is introduced into widely used packages, are a growing variant. You are only as secure as every piece of software you trust.

Surveillance Capitalism

An economic model, named and analyzed by scholar Shoshana Zuboff, in which human experience and behavior are commodified as raw material for prediction products sold to advertisers and other buyers. Under surveillance capitalism, the product is not what you pay for — you are the source of behavioral data that is harvested, analyzed, and sold. The model creates structural incentives to collect more data, more intrusively, regardless of user consent or awareness.

T

Threat Model

A structured analysis of who might want to compromise your security, what they want, what capabilities they have, and which of your assets or behaviors are at risk. A threat model is the foundation of rational security decisions: without one, you’re guessing which measures are proportionate. A journalist’s threat model differs from an executive’s, which differs from an activist’s in an authoritarian state. The question is not “am I secure?” but “secure against what, from whom, at what cost?”

Tor (The Onion Router)

A network that anonymizes internet traffic by encrypting it in multiple layers and routing it through a series of volunteer-operated relays around the world, so that no single relay knows both the origin and destination of the traffic. Tor provides strong anonymity against network-level surveillance but does not encrypt content at the exit node and does not protect against correlation attacks by adversaries who can observe both ends of the connection simultaneously. It is a tool with specific strengths and specific limits.

Traffic Analysis

The examination of communication patterns — timing, volume, frequency, source, and destination — to extract information even when the content of communications is encrypted. Traffic analysis can reveal that you communicate with a specific journalist, that you accessed a particular category of service at a particular time, or that your activity patterns changed following a specific event. Tor and VPNs reduce some forms of traffic analysis but do not eliminate them entirely.

Trust No One (TNO)

A cryptographic design principle in which a system is built so that no single party — not even the service provider — needs to be trusted with users’ plaintext data or encryption keys. A TNO architecture means that even if the provider is compromised, compelled by law, or acts maliciously, they cannot access user data. True end-to-end encryption with client-side key generation is a TNO design; server-side encryption where the provider holds the keys is not.

U

Unicode Spoofing (Homograph Attack)

An attack in which visually identical or nearly identical characters from different Unicode scripts are used to create deceptive URLs, file names, or identifiers. The Cyrillic letter “а” and the Latin letter “a” are visually indistinguishable in most fonts but have different Unicode code points, allowing attackers to register domains that appear legitimate. Unicode spoofing is used in phishing campaigns targeting users who verify URLs visually rather than examining them carefully.

Update Hygiene

The discipline of applying software and firmware updates promptly and consistently across all devices. The majority of successful breaches exploit known vulnerabilities for which patches have already been released — not zero-days. Update hygiene is statistically one of the highest-leverage security behaviors available to individuals: unpatched software is the most common attack surface exploited in both targeted and opportunistic attacks. Enable automatic updates where possible; audit devices that cannot be updated.

V

VPN (Virtual Private Network)

A service that encrypts your internet traffic and routes it through a server operated by the VPN provider, replacing your ISP-visible IP address with the VPN server’s address. A VPN protects your traffic from your ISP and local network observers, but it shifts trust to the VPN provider, who can see everything your ISP previously could. A VPN is not anonymity, does not protect against browser fingerprinting or account-level tracking, and does not change your threat model — it only moves where your trust is placed.

Virtual Machine Isolation

The use of virtualization software to run an isolated operating system instance within your primary system, so that activity in the virtual machine cannot affect the host or other virtual machines. Malware executed inside a virtual machine is typically contained there. Security researchers use virtual machine isolation to safely analyze malicious software; privacy-conscious users use it to segment sensitive activities from everyday browsing and work.

W

Warrant Canary

A regularly updated public statement by a service provider affirming that no secret government orders, gag orders, or national security letters have been received. The statement’s disappearance or failure to update signals to users that such an order has arrived. The legal theory is that while a provider can be compelled to stay silent about an order, they cannot be compelled to lie — so the absence of the canary statement speaks for itself. Named by analogy to canaries once used in coal mines to detect toxic gases.

Web of Trust

A decentralized model of establishing cryptographic identity in which trust is built through mutual verification by peers rather than through a central certificate authority. In the PGP email encryption ecosystem, users sign each other’s public keys to vouch for their authenticity; the more trusted signatures a key accumulates, the more confidently others can trust it. Web of trust systems resist single points of failure but require active participation and careful key management to be meaningful.

Z

Zero-Day

A software vulnerability that is unknown to the vendor and for which no patch exists. The name refers to the number of days the vendor has had to address the problem: zero. Zero-day vulnerabilities are highly valuable to attackers, intelligence agencies, and vulnerability brokers because they provide unobstructed access to any unprotected system running the affected software. Defense against zero-days relies on architectural measures — limiting what a successful exploit can reach — rather than specific patches.

Zero-Knowledge Proof

A cryptographic method by which one party can prove to another that they know a secret — or that a statement is true — without revealing any information about the secret itself beyond the fact of its validity. Zero-knowledge proofs enable privacy-preserving verification: proving you are over 18 without revealing your birthdate, or proving you have sufficient funds for a transaction without revealing your balance. ZKPs are foundational to privacy-preserving blockchain systems and emerging digital identity frameworks.

Zero-Trust Architecture

A security model based on the principle that no user, device, or network connection should be trusted by default, regardless of whether it originates inside or outside the organization’s perimeter. In a zero-trust system, every access request is authenticated, authorized, and continuously validated. The model assumes breach as a baseline rather than an exception, and limits what any compromised account or device can reach. Zero-trust is the architectural response to a world where the network perimeter no longer meaningfully exists.

Why This Glossary Exists

Most people encounter these terms for the first time in a headline about a breach they were caught in, a court case involving surveillance they didn’t know was happening, or a conversation where someone used a word they didn’t understand and were too embarrassed to ask about. The learning happens after exposure, which is precisely when it does the least good.

The premise of this site — and of this glossary specifically — is that the gap between how digital systems actually work and what most people believe about them is not inevitable. It is a product of design: platforms and institutions benefit from your ignorance of how data moves, who holds it, what they can be compelled to share, and what controls you actually have available to you.

Language is the first form of control. You cannot protect metadata you don’t know exists. You cannot demand a no-log policy from a service you use if you don’t know what logs are. You cannot evaluate a VPN provider’s claims if you don’t understand what a VPN actually does and doesn’t do.

This glossary is a reference document, not a manual. It tells you what the terms mean. The practical guides — how to build a threat model, how to harden a device, how to evaluate a communication tool — exist elsewhere on this site. Come back to this page when you encounter a term you don’t recognize. The vocabulary is the foundation. Everything else is built on top of it.

Digital sovereignty is not a product you purchase. It is a set of decisions you make, repeatedly, with increasing competence. It starts with knowing the words.

Where to begin: Proton (the practical starting point). Affiliate link — The Unhacked may earn a small commission at no cost to you; our verdict isn’t for sale.