anologwintermut

15 ms·

91.
by anologwintermut 13y ago
Here's a good reason: in April 2014, Microsoft stops issuing security patches for XP. At that point, any exploits people find(and they will find them) will never be fixed. Your computer will be the easiest target out there. Not just wi
92.
by anologwintermut 13y ago
Given that XP stops getting security patches in April and will then be even more of a problem in terms of botnets , not to mention a security issue for anyone using it , I think a strong case can be made that no, it's not better to gi
93.
by anologwintermut 13y ago
Before they came back up, I ran SSL labs test on their site. It did support forward security for some browsers. Now it supports none. No idea about before the warrant, but I don't see any good reason to think it changed it changed ht
94.
by anologwintermut 13y ago
Why can't that phone be bricked the moment it's reported stolen. Unable to connect to any cell tower in at least North America. Sure, the cops might not track down someone who stole a $600 phone( which is a little absurd), and may
95.
by anologwintermut 13y ago
This is an important distinction, though not iron clad. Lavabit could in theory be ordered to retain records for x days in general. More importantly, though it's obvious to anyone who thinks about how "encrypted" mail works,
96.
by anologwintermut 13y ago
Worse, Lavabit does get clear text emails when they are received. They encrypted them later. The amount of time later is legally irrelevant because they are now in possession of the data and can be made to hand it over.
97.
by anologwintermut 13y ago
I meant MGS 4. Somehow I left out the 4.
98.
by anologwintermut 13y ago
But that would be Steam OS exlcusive, not actually on any other Linux distro. So while it might trickle down to better game dev tool support in linux, it wouldn't on face effect adoption rates. If you say that SteamOS means a game is L
99.
by anologwintermut 13y ago
Physical security is the least of his problems. You can mount a lot of tempest[0]/ attacks from across the street. http://en.wikipedia.org/wiki/Tempest_(codename)
100.
by anologwintermut 13y ago
or he knows that NSA can own both Windows and Linux. Which is probably true. At which point, he needs to 1) know his system is not yet owned and 2) that the encryption system he uses works and isn't backdoored. So about his only plausi
101.
by anologwintermut 13y ago
Not the Microsoft Skype wiretap memee again. Read the PRISM slides, Skype was tapped before Microsoft bought the company, let alone rearchitected the system
102.
by anologwintermut 13y ago
I highly doubt construction works make 250k a year at least if you account for down time. RegardlessLabor costs don't explain massive cost over runs. If the amount of labor were accurately predicted, it would just inflate the cost, not
103.
by anologwintermut 13y ago
He had the fastest algorithm for pancake sorting for a long time. Not the coolest thing, but still pretty impressive and not just can code. http://www.npr.org/templates/story/story.php?storyId=9223678...
104.
by anologwintermut 13y ago
Apple, Sony, and everyone still uses Foxconn to make their stuff and it appears no one has boycotted the client company's products over it. I think as it stands right now, it makes them money. Of course morally, someone should fix it.
105.
by anologwintermut 13y ago
Isn't the most obvious choice for things that require performance but are too complicated to write in C, C++? Isn't Java the choice for things that aren't performance critical but are too complicated to write in C? Java survi
106.
by anologwintermut 13y ago
I took that to mean his case revealed the FBI could get SSL keys under gag order, not that that was their objective in his case from the onset. (though given that they got them, the keys probably would end up in that database, hence why he
107.
by anologwintermut 13y ago
I agree with your point about Levison's own politics for refusing the initial limited request getting him in this situation. I also think he could be considerably more honest that this is what happened. But even by that standard, the h
108.
by anologwintermut 13y ago
The original order[0]( see Appedix A of Exhibit one on Page 4) wasn't even for everyone's data, just data(mainly envelope information and IP addresses) on one account(likely Snowden's). So yes, thats incredibly bad reporting
109.
by anologwintermut 13y ago
I did actually miss that part. I figured he gave them an electronic copy when he shut down. Minimally, he gave them an "illegible copy." in 4 point font.Assuming its the actual key, I'm sure the FBI or NSA can OCR that. Even
110.
by anologwintermut 13y ago
The original order wasn't for SSL keys or even Snowden's emails, it was for the envelope information and the IPs he was connecting from (see page 4 of http://cryptome.org/2013/10/lavabit-orders.pdf ) They
111.
by anologwintermut 13y ago
It's entirely possible it's an inaccurate account of events. I haven't read all of the primary documents, just secondary sources. In your linked documents,Exhibit 1 is the original June 10th order. Attachment A of it(page 4 o
112.
by anologwintermut 13y ago
The government already got to seize private keys when they got search warrants and ceased servers. I'd imagine this is the case in all of Western Europe.
113.
by anologwintermut 13y ago
Anyone using Safari or IE apparently isn't getting a forward secure connection to https://Lavabit.com . They end up with TLS_RSA_WITH_AES_256_CBC_SHA according to SSLLabs[0]. Since things escalated to the point where Lavab
114.
by anologwintermut 13y ago
You can only support forward secure cipher suits. This will result in rejected connections as you suggested. Lavabit doesn't do this, they support non-forward secure ones. Worse, they don't offer a cipher-suit order preference and
115.
by anologwintermut 13y ago
If you cared about security and knew enough to check that, you probably knew enough not to trust server side crypto and were using PGP or S/MIME on top of it or using OTR instead of email for secure conversations. That aside, this sti
116.
by anologwintermut 13y ago
I did. I even quoted it here https://news.ycombinator.com/edit?id=6517845
117.
by anologwintermut 13y ago
I did. You either didn't or read what you wanted to read. The FBI didn't ask for SSL keys right off the bat. They asked for info on Snowden's account. After Lavabit refusing and then agreeing but allegedly dragging it's
118.
by anologwintermut 13y ago
Right. But if you connect with a browser that doesn't support that? And what about SMTP connections?
119.
by anologwintermut 13y ago
Did he actually use forward secure SSL cipher suites for everything?
120.
by anologwintermut 13y ago
The story, as far as I have read from this article and others, was they asked for data(probably with an NSL), he said no. They got a court order. He said no. At some-point he was willing to cooperate, but by that point, they didn't ca

More ›