3 ms·
What I first replied to is about a specific private key algorithm that doesn’t have any patterns, and using it over something that can’t be backdoored. Using OT
by opportune 6y ago
What I first replied to is about a specific private key algorithm that doesn’t have any patterns, and using it over something that can’t be backdoored. Using OTP is not just using crypto, it is pretty much the only “uncrackable” encryption if used properly.
My point is that using something like PGP to communicate over TOR (or even OTP over TOR) doesn’t matter if whoever you are trying to hide from has a backdoor to your OS or has the ability to exploit a vulnerability in your OS (which only requires something trivial like you having loaded some random JS in the past year). And there is no way to protect against an undocumented bug in some software you depend on other than to not use it. You can only hope that a government or criminal doesn’t care enough to burn a 0day on you.
(Of course you can still airgap a computer with the private PGP key and manually copy the encrypted data over but the question then is whether that is worth the minuscule chance of it mattering)
- ethbr0 6y ago> no way to protect against an undocumented bug in some software you depend on I understand the point you're making, but I feel like it's overstating the frequency. Of all the code in a piece of software, only some amount will have bugs. Of those bugs, only some will be executable in your configuration. Of that buggy code, only some will create security issues. Of those security issues, only some will be network-exploitable. That's a lot of partitioning. So it's fair to say systems run on other systems, but I don't think it's fair to say it's likely that every system has an undiscovered, network accessible security vulnerability.