dguido

28 ms·

241.
by dguido 11y ago
> My intuitions are generally with you, but Tor developers have claimed that low-latency anonymity against a pervasive network adversary may be impossible, and formally excluded it from their threat model back in 2004. This is a point th
242.
by dguido 11y ago
Thanks, that would be great! Yes, I would very much like to see options to strip down Streisand. I'm not worried about getting my packets filtered by the Great Firewall. I'd rather have the minimum number of agents necessary: IKEv
243.
by dguido 11y ago
> Saying that Tor is just a LEA honey-trap is just plain FUD. Explain why the FBI has been able to unmask nearly every high profile hidden service operator they go after then? Each time it's a different strategy, and they have all b
244.
by dguido 11y ago
> I'm guessing that Amazon knows who you are. And I'm sure that they keep logs, for accounting and debugging. So being "one of a million EC2 nodes" doesn't hide you, in any way. That EC2 node has an IP address. W
245.
by dguido 11y ago
I'd rather be one of a million EC2 nodes for a day, then share a single egress point with hundreds of thousands of other people for a year. I guess in a way they're somewhat of the same thing, right? How much traffic do you think
246.
by dguido 11y ago
That's what I'm asking for. Check the Tinfoil Security link.
247.
by dguido 11y ago
This is pretty useless. Put them all under the category of "centralized one-hop VPN." Each of these is a sitting duck for surveillance, law enforcement, hackers, and more! It doesn't even matter who runs it, each one is an at
248.
by dguido 11y ago
Hah, we wrote one of these too. It's fun! Our code for it is super clean and documented if you want to learn how to use WebRTC: https://github.com/trailofbits/tubertc The hardest part is getting the signaling to w
249.
by dguido 11y ago
Existing discussion: https://news.ycombinator.com/item?id=11114366
250.
by dguido 11y ago
Page 11 of the iOS Security Guide should help explain a lot: https://www.apple.com/business/docs/iOS_Security_Guide.pdf The user passcode is combined with the UID Key embedded in the Secure Enclave to create an en
251.
Tidas: a new service for building password-less apps(blog.trailofbits.com)
4 points by dguido 11y ago|0 comments
252.
by dguido 11y ago
I was far more interested in this article when I thought the title was "Concurrency War" :-(
253.
by dguido 11y ago
Anyone that knew anything about security knew that Norse was full of it. Norse is a shining example of how little information most people have about the security products and services they buy. It's all marketing, and it leads to more
254.
by dguido 11y ago
That would help with things like the memory safety of the daemons you run, but that hasn't been the problem when Tor has failed its users. Tor has failed its users because the idea of running a public Tor cloud with volunteer entry, on
255.
by dguido 11y ago
As I said, pretty sure that disassemblers and debuggers and emulators and binary code analysis tools are a thing. I've made a living off deconstructing binary code in the past.
256.
by dguido 11y ago
> already been feeling the heat I think you're misdiagnosing where Tor is "feeling the heat" from. From an engineering perspective, it's been oversold as solving problems it can never hope to. People who route their t
257.
by dguido 11y ago
As far as I can tell, this prevents countries from demanding source code to a closed source product as a condition for selling into a country. Seams reasonable? If you want to audit a closed-source program for bugs and backdoors, people hav
258.
by dguido 11y ago
It's still being worked on. Turns out, getting these things right from a crypto and a UX perspective is hard.
259.
by dguido 11y ago
Can they do "Underground Thursdays"? Nearly every app degrades to unusable the second I get on the subway.
260.
by dguido 11y ago
Yes! The world needs this kind of work. I would prefer my flight control computers to be free of bugs, provably. DARPA just concluded a program to do exactly this, and I wonder if Veridrone was funded as part of their efforts: http:/&
261.
by dguido 11y ago
Don't forget these functional alternatives to OpenSSL: 1. OCaml-TLS ( https://github.com/mirleft/ocaml-tls ) [1] 2. miTLS ( http://www.mitls.org/wsgi/home ) 3. s2n ( https://github.com&
262.
by dguido 11y ago
Symantec fired everyone responsible, damn: http://www.symantec.com/connect/blogs/tough-day-leaders
263.
by dguido 11y ago
Probably not: "The initial infection doesn't appear to exploit any vulnerabilities in Cisco devices. Rather, attackers seem to be taking advantage of routers that use passwords that are factory default or are somehow otherwise kno
264.
by dguido 11y ago
I think to show that it's more than an isolated incident. This is not a piece of research malware that was only deployed in a lab or got picked up on a fileshare. It was found, deployed and operating, on many routers. It alludes to a s
265.
by dguido 11y ago
You should try using nsjail, which makes using namespaces and seccomp-bpf easy. It's very simple, it's made to wrap existing programs with a single command line invocation. Done and done. https://github.com/google&
266.
by dguido 11y ago
OWASP is a massively disorganized, vendor-driven, volunteer (read: soapbox-as-a-service) organization littered with half-completed, abandoned projects. That said, there are a small few that are "ok". I like using ASVS as a checkli
267.
by dguido 11y ago
Because they use OFX for read-only transactions and an HSM to store the passwords: http://money.stackexchange.com/questions/15392/are-there-any...
268.
by dguido 11y ago
Doesn't Firefox make a dozen HTTP requests the first time you open it? And have ads on the start page? And have the only modern browser without a sandbox? This emperor has no clothes.
269.
by dguido 11y ago
This helps keep the org fresh, new talent coming in and out all the time and there are side benefits in reducing potential corruption. You come in with your big ideas, you get a chance to try them, and then you're out to make way for t
270.
by dguido 11y ago
Projects related to Tor were funded as part of the Memex project. DARPA only funds transformational research, not iterative improvements to existing technology, so simply funding "Tor" is not a thing they would do.

More ›