Voice as proof of humanity. Helix, a startup founded in 2025, has raised $6.2 million in a round led by Chicago Ventures to sell voice-based verification that runs directly on a user’s device, checking that a speaker is a unique human and estimating age without collecting identity documents. Siri co-founder Dag Kittlaus is backing the company and will advise it. Helix says its model runs locally even on an iPhone 13, that one customer, in-home healthcare provider Zeel, uses it to verify workers visiting customers’ homes, and that it positions the four-second voice challenge as a privacy-preserving alternative to the document checks that age-verification rules are spreading. The company is candid that the technology cannot reliably detect lying and is not yet able to reliably spot AI agents in live calls.
AWS, emulated on a laptop. Amazon Web Services has released AWS Emulator, a local program written in Rust that serves AWS API endpoints on a developer’s own machine, so software can be tested against AWS APIs without calling the cloud and without charge. It covers services that have an API model in AWS’s models repository, more than 1,300 items, and AWS publishes fidelity scores for how closely each service matches the real cloud. It does not evaluate IAM policies the way AWS does and acts as a single account with no cross-account or cross-region behaviour. AWS documentation also describes an agent skill that lets coding agents check which parts of a project the emulator can be trusted for.
A buggy script behind single-byte keys. Former certificate authority eMudhra has posted its account of how it came to issue certificates backed by trivially weak private keys, blaming a bug in a custom Python key-handling script used during a single key-generation ceremony on April 30, 2025. The script’s import code truncated the read-back of unwrapped keys, so 16 subordinate CA key pairs in its B and C series were certified against private scalars far below the expected range, in one case effectively the number four, recoverable from public information. The company said it resorted to the script because supply constraints kept it from acquiring the hardware security modules it wanted, and that it did not test the keys it created. Browsers stopped trusting its certificates after a Mozilla team member spotted the weakness, and eMudhra has since quit the SSL and TLS certification business.