4 ms·

Summary: http://www.seif.place http://www.seif.place "HTML free based application delivery system based on [stripped down] node.js and QT" He describes a "He

by yoo1I 11y ago

Summary: http://www.seif.place http://www.seif.place "HTML free based application delivery system based on [stripped down] node.js and QT" He describes a "Helper Application" that he wants to convince browser vendors to install. Features as I gleaned them from this talk. - Replace DNS addressing with <publickey>@<ipaddress>/<referral> (since these are not human friendly: QRcodes and Petnames) - Replace HTTP with a "Secure JSON over TCP" - Content based addressing through file hashes - communicate with QT through a messaging protocol - For some reason reinvents an RNG(!) (what?) (EDIT: this originally said "running in Javascript(!)", based on the git repository that's probably not true) - apparently no password will be needed ever again All of it sounds a bit hyperbolic... (OK I admit it, I stopped taking it seriously when he mentioned the awesome idea of adding microphone/camera input into the RNG for randomness, that just sounds like something which seems common sense on the surface, but is a totally incorrect thing to do in practice).

yoo1I 11y ago
Based on the information that's in there, this makes mutual authentication based on TLS certifictes (or some other public-key-scheme) mandatory, and uses it for addressing. The only information that this talk contains about how to solve the introducton,authentication problem is this (paraphrasing): "I don't trust Verisign to prove someone's identity, but I trust google's search results" (As in "I googled for ACME Bank, and this is the address/public key that was returned, I am going to trust it") The whole thing feels like something someone would come up in an afternoon with lot's of handwaving potential problems away.
keville 11y ago
> is a totally incorrect thing to do in practice Can you elaborate on this? I understand that there are many sources of entropy for random number generation, and it seems like this would be as good a way as any to store* a pool of some for future use. (* Is it that the storage is the inherent problem?)
- yoo1I 11y ago
  Hi, sorry for the late reply. I meant it in the sense that it seems intuitively correct that you'd be able to get some random data out of a microphone somehow, but that intuition doesn't serve as a good adviser in cryptography. I bet just looking at a recording from a computer microphone, it's possible to make deductions about it's structure. Let's say there are people in the room who talk with a certain pitch, the frequency of the AC current as it get's into the computer, things like that which all make the microphone output non-random. So it might be that there is a way to generate true random numbers like that, but it's probably not as easy as just using the microphone as a source of entropy.

by yoo1I 11y ago

yoo1I 11y ago

Based on the information that's in there, this makes mutual authentication based on TLS certifictes (or some other public-key-scheme) mandatory, and uses it for addressing. The only information that this talk contains about how to solve the introducton,authentication problem is this (paraphrasing): "I don't trust Verisign to prove someone's identity, but I trust google's search results" (As in "I googled for ACME Bank, and this is the address/public key that was returned, I am going to trust it") The whole thing feels like something someone would come up in an afternoon with lot's of handwaving potential problems away.

keville 11y ago

> is a totally incorrect thing to do in practice Can you elaborate on this? I understand that there are many sources of entropy for random number generation, and it seems like this would be as good a way as any to store* a pool of some for future use. (* Is it that the storage is the inherent problem?)

yoo1I 11y ago
Hi, sorry for the late reply. I meant it in the sense that it seems intuitively correct that you'd be able to get some random data out of a microphone somehow, but that intuition doesn't serve as a good adviser in cryptography. I bet just looking at a recording from a computer microphone, it's possible to make deductions about it's structure. Let's say there are people in the room who talk with a certain pitch, the frequency of the AC current as it get's into the computer, things like that which all make the microphone output non-random. So it might be that there is a way to generate true random numbers like that, but it's probably not as easy as just using the microphone as a source of entropy.