Quantum Risk, in Plain English

LaMarr LabsLaMarr Labs

What To Do MOC

4 min read

up:: 00 Start Here

What To Do

There’s very little for you to do personally, and that’s good news rather than a brush-off.

Almost all of the repair happens above your head, by the companies and institutions running the systems you use. A lot of it has already happened. What’s left for you is short, free, and mostly about not making the permanent problems worse.

Anybody telling you otherwise is usually selling something.

5 things you must understand about Q-Day

  1. The repair is happening above your head. Almost all of it belongs to the companies and institutions running the systems you use, which is why the personal list is short.
  2. Part of it already happened on your devices without any announcement. Signal deployed it in 2023, Apple in February 2024, Firefox in October 2024, and Chrome and Edge in November 2024, when it extended the same post-quantum key exchange to HTTP/3.
  3. No consumer product fixes this. Anything marketed to individuals as quantum protection is charging for a problem it doesn’t address.
  4. What’s yours is small. Keep devices updated, be careful about what you hand over permanently, and delete what you’re finished with.
  5. It only matters for information still sensitive years from now, which means for most of your daily activity, nothing changes.

Source: Signal, “PQXDH,” signal.org; Apple Security Research, “iMessage with PQ3,” February 2024, security.apple.com; Google Security Blog, “A new path for Kyber on the web,” September 2024, security.googleblog.com; Mozilla, Firefox 132 release notes, firefox.com. Those 4 cover Signal, Apple, Firefox, and Chrome’s switch to ML-KEM in Chrome 131. The Google post names no month and says nothing about Edge or HTTP/3, so the November timing and the Edge and HTTP/3 detail are this page’s own read.

The short version:

  • Keep your devices and apps updated. That’s the whole consumer action item that matters, and it’s why Signal and iMessage users already have the protection without asking for it.
  • Use a messaging app that’s already been upgraded for anything that has to stay private for years.
  • Delete what you’re finished with. Data you’ve already deleted can’t be copied from you later.
  • Think hard before another DNA test or biometric enrollment, because neither can be withdrawn and a DNA test enrolls your relatives too.
  • Ask your doctor, bank, and insurer what their timeline is. They hold the categories that actually matter.
  • Buy nothing. No consumer product fixes this, and the ones being marketed are charging for a problem they don’t address.

What lives here

  1. What should I actually do? The full list, in order, with the reasoning behind each one.
  2. Did my phone already fix this? Signal, Apple, and the browsers changed their encryption and never told anyone.
  3. What should my doctor and my bank be doing? The standard to hold an organization to, and the one question that exposes whether they’ve started.
  4. Is anyone selling me something I don’t need? Yes, and here’s how to recognize it.
  5. How do I ask a company what their quantum plan is? A copy-and-paste template for your bank, your doctor, or anyone else holding your records, with the sourced urgency paragraph and how to tell a real answer from a brush-off.

Where to go next

Go deeper into the technical detail

The arguments cover the two traps that catch teams in motion: Deprecation, Not Deployment on why adding the new algorithm is not the same as being protected, and Can AI Build Your Cryptographic Inventory on what AI can and cannot do for the inventory. The technical version of the organizational work lives at Start a Migration and Doing the Work MOC.

These open the Post-Quantum Field Guide, a separate site written for security professionals.

Last verified 2026-09-01 · Maintained by Addie LaMarr, LaMarr Labs.

Graph View

Backlinks