5 ms·
Bizarre Design Choices in Zoom’s End-to-End Encryption
- Trowter 6y agoWhat is the furry shit all over this website?
- johnghanks 6y agoyeah super cringe.
- minitech 6y agoI think you answered your own question
- erwinkle 6y agoI think it's great and full support it. Cool art imo
- ironSkillet 6y agoThey explain their reasoning in the "about" section of the blog. I personally think it makes it hard to focus on the technical content in the blog, but to each their own.
- lhorie 6y agohttps://i.redd.it/4by1ithm81a51.png https://i.redd.it/4by1ithm81a51.png Summarizes the author's stance on comments about his fursona
- scubbo 6y agoHo ho, bookmarking this for future use :P
- some_furry 6y agoThe original that inspired my version: https://floccinaucinihilipilificationa.tumblr.com/post/96040472380 https://floccinaucinihilipilificationa.tumblr.com/post/96040... The furry version was made by https://twitter.com/loviesophiee https://twitter.com/loviesophiee
- joe-collins 6y agoIt's atypical, but I can dig it.
- DoctorNick 6y agoBecause it fuckin' rocks, that's why.
- dang 6y agoPlease don't take HN threads on generic tangents. I realize that that kind of thing can be provocative—we all have our buttons—but the idea here is to resist provocations toward the less interesting. https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
- deleted 6y ago[deleted]
- josh2600 6y agoAs always: show us the source code if there's nothing to hide.
- paxys 6y agoWhy is the author so fake-surprised that the source code isn't available on the internet? Zoom isn't open source software, and has never claimed to be. The title is also pure clickbait, since the article itself comes to the conclusion that the design is secure and the oddities are likely due to the need for legacy support.
- eat_veggies 6y agoPure clickbait? The design choices are indeed bizarre, even if the reason ends up being for legacy support, no?
- corty 6y agoWell, bizarre would be using SHA3, some GOST algo, or maybe putting some postquantum crypto in there. The article describes something that is just a little strange.
- minitech 6y agoPQC would be more interesting than bizarre and SHA-3 wouldn’t be bizarre at all (it’s a straight improvement on SHA-2 in isolation).
- bawolff 6y ago> (it’s a straight improvement on SHA-2 in isolation). That's debatable.
- tialaramex 6y agoRight, the only technical sense in which SHA-3 is simply "a straight improvement on" SHA-2 is resistance to length extension, but you can have that with SHA-512/256 (yes that's the name of one SHA-2 family member, if you didn't already know that, and you were previously confident SHA-3 is what you needed, time to do some reading). In a non-technical sense to be sure 3 is a bigger number than 2 but that's a terrible reason to do anything. Keccak's sponge construction is novel, it has some cool features compared to Merkle–Damgård but when SHA-3 was standardised we had very little experience with this construction. Now, maybe we lucked out and these are the perfect parameters, not too slow, not too weak. But most likely we went too far in one direction and so hence "Maybe Skip SHA-3" https://www.imperialviolet.org/2017/05/31/skipsha3.html https://www.imperialviolet.org/2017/05/31/skipsha3.html
- RedComet 6y agoWhy is the post littered with unrelated and revolting humanoid dog art?
- dqv 6y agoSomeone already asked, but I imagine it's the same reason one might put women in lingerie or men in underwear in their blog posts.
- RedComet 6y agoThat's disturbing.
- klyrs 6y agoIt's a test. Do HN readers evaluate articles purely on the quality of their contents, or do we also judge on the basis of the author's identity and associations? For example, I found this conversation to be rather interesting: https://news.ycombinator.com/item?id=24078739 https://news.ycombinator.com/item?id=24078739
- Kye 6y agoIt is interesting because one popular narrative on here is that the message is what matters, and it doesn't matter if the personality delivering it is revolting. But that narrative seems to have an exception for what some people find revolting. Personally, I think the art should increase in size by one pixel every time someone complains.
- dqv 6y agoI don't really care about the art and I don't know enough about the author to judge him. I do know that I am not fond of certain HN personalities, namely patio11 and jacquesm, which makes me more skeptical of the things they say.
- RedComet 6y ago
- ljm 6y agoI have to admit that I felt that the title wrote a cheque that it failed to cash. I'm not sure who the intended audience is. It's light on crypto and it's light on furry stuff. I think both audiences will feel short-changed.
- geoah 6y agoHehe, you're not wrong on the lightness but I have to say I did enjoy the change of style and pace. Artwork was a nice touch as well.
- matthewaveryusa 6y agoI think some of the oddities can come from looking at sha256 as a way to make variable length data fixed length. Hashing the context and message before signing has the fingerprints of starting with RSA and pivoting later to ed25519. Janky for sure but really not bad at all. HMAC is cool and all, but from a practical standpoint you can do with concatenation if the message is prefixed with length, or you are using an algo such as blake2 where the keyed mode is prepending the key and the internal state does not allow for extension attacks.
- technion 6y agoTheorycrafting: Is this choice of two SHA256's of different data a case of hedging your bets against a canonicalisation attack that may be involved in SHA512(Context || M).
- some_furry 6y agoThe /r/crypto discussion on this might be worth considering too: https://old.reddit.com/r/crypto/comments/jkeq0z/bizarre_design_choices_in_zooms_endtoend/ https://old.reddit.com/r/crypto/comments/jkeq0z/bizarre_desi...
- bawolff 6y agoOk, not using hmac in that one case is a mildly weird choice, but the criticism for choosing sha256 over sha512 seems a bit much to me. I was expecting much more.