4 ms·

Matthew Green wrote zerocash, the protocol behind zcash, and he teaches cryptography at John Hopkins. When it comes to cryptography he knows enough to have opi

Matthew Green wrote zerocash, the protocol behind zcash, and he teaches cryptography at John Hopkins. When it comes to cryptography he knows enough to have opinions. It's hard to opine about black box systems, which is why open-source is so important. It's hard to trust what you can't verify.

dcow 5y ago
I don't disagree but like if you want an open system why are you using an iPhone? Maybe Green is a little guilty of slurping up Apple's privacy marketing?...
- backspace_ 5y ago
  Everyone is quite an absolute word. How are non apple users slurping up Apple's privacy marketing?
  - dcow 5y ago
    Edited.
- burkaman 5y ago
  You can read more of his iPhone-related writing here: https://blog.cryptographyengineering.com/category/apple/ https://blog.cryptographyengineering.com/category/apple/ I'm not sure how concerned he is that it's closed source, I think in this case he was just surprised that the implementation details and security considerations weren't documented anywhere: https://twitter.com/matthew_d_green/status/1443382207838621703 https://twitter.com/matthew_d_green/status/14433822078386217... Note that he was relatively positive about this feature when it came out two years ago: https://blog.cryptographyengineering.com/2019/06/05/how-does-apple-privately-find-your-offline-devices/ https://blog.cryptographyengineering.com/2019/06/05/how-does.... It seems like the motivation for this tweet was "wow I do a lot of iPhone security research and I didn't know this worked when the phone is off, I'm surprised Apple doesn't document the details of this anywhere." Remember that it's hard to interpret tone through the internet, and as someone that doesn't get a ton of engagement on Twitter, he probably doesn't feel like he's writing for a mass audience.
  - dcow 5y ago
    This is no surprise to me knowing Apple's history. Honestly I think I was just annoyed by his twitter personality, but I guess I shouldn't find "twitter personas found to be annoying" surprising either.
- dylan604 5y ago
  At this point, there's only two mobile OS players. All of these upstarts don't have enough market share to count (hopefully, just for now). Nobody's family members use something other than iOS/Android. Maybe some of your friends do, but that's a small market. With that established, just because one uses iOS/Android does not mean they are not about openess or security or privacy or whatever. It probably just means they are a human being that has only so much time in their life and they need a mobile device that works and operates with their friends and families. Just like why people continue to use FB/Twit/blah; that's where the people are.
  - dcow 5y ago
    Which is why his twitter thing felt so odd and uncharacteristic especially coming from a professor of cryptography nonetheless. AOP has been around for years. If he's made the concession to use an iPhone because that's where people are, why freak out about some new feature like you were born yesterday? This is Apple, you know they don't document shit. Go look at core crypto... it's doc-gen function signatures and structs. They don't even tell you how big their chacha20-poly1305 nonce is. The only reason they have a security handbook is so that the government would approve iPhone use. Why not look at the prior art out there surrounding the protocol published by people who are concerned like you are and weigh in as a security expert instead of having a twitter fit and then throwing HN under the bus when they point this shit out to you and say "hmm he's kinda overreacting this isn't news and actually the protocol is pretty good".
    - dylan604 5y ago
      I totally agree this totally feels like someone making noise to get attention even though the subject is closer to a mole hill approaches mountain in stature. I just think the attack "smart guy" for using iOS/Android meme is lame.
      - dcow 5y ago
        I mean I advocate for open systems that can be audited and verified and I still use an iPhone as a daily too although I've been exploring the pinephone on my other sim. I get it. That wasn't my intention to attack the smart guy for using an iPhone. More just like "what do you expect"?
shuckles 5y ago
Offline finding isn’t a black box system, though. It was presented at Black Hat, and there is a well-known 3rd party implementation. This feature brings offline finding to more cases. In addition, if this person is a well-regarded professional, then indignant tweeting is even more concerning because the general public has no way of knowing that they’re just misinformed.

dcow 5y ago

I don't disagree but like if you want an open system why are you using an iPhone? Maybe Green is a little guilty of slurping up Apple's privacy marketing?...

backspace_ 5y ago
Everyone is quite an absolute word. How are non apple users slurping up Apple's privacy marketing?
- dcow 5y ago
  Edited.
burkaman 5y ago
You can read more of his iPhone-related writing here: https://blog.cryptographyengineering.com/category/apple/ https://blog.cryptographyengineering.com/category/apple/ I'm not sure how concerned he is that it's closed source, I think in this case he was just surprised that the implementation details and security considerations weren't documented anywhere: https://twitter.com/matthew_d_green/status/1443382207838621703 https://twitter.com/matthew_d_green/status/14433822078386217... Note that he was relatively positive about this feature when it came out two years ago: https://blog.cryptographyengineering.com/2019/06/05/how-does-apple-privately-find-your-offline-devices/ https://blog.cryptographyengineering.com/2019/06/05/how-does.... It seems like the motivation for this tweet was "wow I do a lot of iPhone security research and I didn't know this worked when the phone is off, I'm surprised Apple doesn't document the details of this anywhere." Remember that it's hard to interpret tone through the internet, and as someone that doesn't get a ton of engagement on Twitter, he probably doesn't feel like he's writing for a mass audience.
- dcow 5y ago
  This is no surprise to me knowing Apple's history. Honestly I think I was just annoyed by his twitter personality, but I guess I shouldn't find "twitter personas found to be annoying" surprising either.
dylan604 5y ago
At this point, there's only two mobile OS players. All of these upstarts don't have enough market share to count (hopefully, just for now). Nobody's family members use something other than iOS/Android. Maybe some of your friends do, but that's a small market. With that established, just because one uses iOS/Android does not mean they are not about openess or security or privacy or whatever. It probably just means they are a human being that has only so much time in their life and they need a mobile device that works and operates with their friends and families. Just like why people continue to use FB/Twit/blah; that's where the people are.
- dcow 5y ago
  Which is why his twitter thing felt so odd and uncharacteristic especially coming from a professor of cryptography nonetheless. AOP has been around for years. If he's made the concession to use an iPhone because that's where people are, why freak out about some new feature like you were born yesterday? This is Apple, you know they don't document shit. Go look at core crypto... it's doc-gen function signatures and structs. They don't even tell you how big their chacha20-poly1305 nonce is. The only reason they have a security handbook is so that the government would approve iPhone use. Why not look at the prior art out there surrounding the protocol published by people who are concerned like you are and weigh in as a security expert instead of having a twitter fit and then throwing HN under the bus when they point this shit out to you and say "hmm he's kinda overreacting this isn't news and actually the protocol is pretty good".
  - dylan604 5y ago
    I totally agree this totally feels like someone making noise to get attention even though the subject is closer to a mole hill approaches mountain in stature. I just think the attack "smart guy" for using iOS/Android meme is lame.
    - dcow 5y ago
      I mean I advocate for open systems that can be audited and verified and I still use an iPhone as a daily too although I've been exploring the pinephone on my other sim. I get it. That wasn't my intention to attack the smart guy for using an iPhone. More just like "what do you expect"?

shuckles 5y ago

Offline finding isn’t a black box system, though. It was presented at Black Hat, and there is a well-known 3rd party implementation. This feature brings offline finding to more cases. In addition, if this person is a well-regarded professional, then indignant tweeting is even more concerning because the general public has no way of knowing that they’re just misinformed.