garrettr_

9 ms·

31.
by garrettr_ 10y ago
If the codes are time-based (TOTP), they are typically generated with a rolling window of 30 seconds (as you saw in Google Authenticator). The 30s rolling window is the recommended (and widely implemented) default value from the TOTP RFC [0
32.
by garrettr_ 10y ago
pshtt (the HTTPS scanning tool) also powers the results for Freedom of the Press Foundation's recently launched Secure The News project: https://securethe.news . (Full disclosure: I work for FPF, and worked on Secure the New
33.
by garrettr_ 10y ago
True, although sometimes it's good to deliver signed updates over a secure connection for defense-in-depth - for example, to mitigate vulnerabilities like the recent CVE-2016-1252.
34.
by garrettr_ 10y ago
> It seems to have been untouched since, and no sign of an actual solution... They're working on it! There will be a talk about this about Real World Crypto 2017 in January, see "Solving the Cloudflare CAPTCHA" on the RWC
35.
by garrettr_ 10y ago
> Too slow. RSA encryption is very expensive. So use a public-key algorithm that is designed to be faster, less expensive, and use smaller keys -- e.g. NaCl's crypto_box, which uses Curve25519 under the hood: https://nacl
36.
by garrettr_ 10y ago
I'm probably just inviting myself to get trolled by replying to this, but this comment is just ridiculously wrong on so many levels. > The fact that the guy behind it is hyping it via the New York Times, a generalist publication, in
37.
by garrettr_ 10y ago
> It does obscure the size Encryption does not inherently obscure the size of plaintext. Protocols may choose to pad plaintext for various reasons, and both Tor (since Tor always sends fixed-width cells) and TLS (when it uses a block cip
38.
by garrettr_ 10y ago
Right, and this answers the parent's question. Currently, the layout of the HSDir is deterministic and therefore predictable by anyone, which allows for a number of potential attacks. See "Non-Hidden Hidden Services Considered Har
39.
by garrettr_ 10y ago
If you want to donate towards the operation of "safe" exit/bridge nodes, consider donating to NoiseTor: http://noisetor.net/ .
40.
by garrettr_ 10y ago
Key feature for me would be the ability to switch/manipulate tasks through the keyboard only. Nice PoC!
41.
by garrettr_ 10y ago
This comment seems to imply that you're using a transport layer security mechanism < TLS 1.0, i.e. SSLv2 or SSLv3. I strongly encourage you to upgrade to TLS 1.1 or newer.
42.
by garrettr_ 11y ago
I always liked "Axolotol" because axolotols are a type of salamander with the amazing ability to regenerate parts of their bodies (including their brains!), and the Axolotol protocol, like OTR, is "self-healing", meaning
43.
by garrettr_ 11y ago
Just use WhatsApp :)
44.
by garrettr_ 11y ago
> Do you have an account recovery flow? Delete it immediately. What about users who need to, you know, recover their account?
45.
by garrettr_ 11y ago
Firefox's Tracking Protection is not the same as Do Not Track (which "tells websites to not track my preferences so they can gauge what ads to show"). DNT is simply an advisory header and it has no effect because very few web
46.
by garrettr_ 11y ago
Well, unauthenticated DH ("simple DH without any long term secret") is trivially MITM-able, so it could only be useful if you adversary could read but not write to the channel, which I doubt is the case in this context.
47.
[LIVE] Congressional Hearing on Encryption and Federal Investigations(c-span.org)
2 points by garrettr_ 11y ago|0 comments
48.
by garrettr_ 11y ago
If you control the sites, just modify their server configuration so they send the HPKP header. If you don't control the sites, it is not a good idea to pin them "from the browser" as you suggest.
49.
by garrettr_ 11y ago
Have you taken a look at Cyph (mentioned elsewhere in this thread)? Their app is also basically cryptocat, but they've taken the time to engineer an interesting solution [0] to the "Trust on Every Use" problem that secure web
50.
by garrettr_ 11y ago
Freedom of the Press Foundation (disclosure: I am an employee) ships grsecurity kernels for SecureDrop. You have to build them yourself, but it really isn't that hard to do. We're working on making this easier for everybody by pub
51.
by garrettr_ 11y ago
This vulnerability is a great advertisement for grsecurity/PaX, which mitigates it at the source of the issue thanks to PAX_REFCOUNT.
52.
New documents on Justice Dept's secret rules for investigating journalists(freedom.press)
3 points by garrettr_ 11y ago|0 comments
53.
by garrettr_ 11y ago
Not really, especially in the context of RSA keys, because: 1. RSA is a slow algorithm and gets slower as you increase the key size. 2. Increasing the key size gets diminishing returns on the security margin. Given the performance and compa
54.
by garrettr_ 11y ago
Sure! There are a lot of ways you can do this. One is to use PIV mode, which exposes a PKCS#11 interface that can be used by OpenSSL. Yubico has some nice docs on using a Yubikey as an HSM to store CA keys: https://developers.yub
55.
by garrettr_ 11y ago
If you use Tor, or want to support those that need it to communicate safely online, consider donating to (their first ever!) end-of-year fundraising drive: https://blog.torproject.org/blog/our-first-real-donations-ca...
56.
by garrettr_ 11y ago
> By ensuring that no person could obtain an advantage over others, and by ensuring that anyone could join without exclusion, Satoshi created the Nash equilibrium to permit normally byzantine parties to enter and share safely in the defi
57.
Publishing the unredacted SecureDrop 0.3.4 audit report(freedom.press)
1 points by garrettr_ 11y ago|0 comments
58.
by garrettr_ 11y ago
Agreed, my favorite thing about Firefox OS was always the "blank-slate" approach to writing apps for it, based on web technologies. Of course, that was good and bad - there was more room for experimentation, but you had to do more
59.
U.S. Mass Surveillance Has No Record of Thwarting Large Terror Attacks(theintercept.com)
269 points by garrettr_ 11y ago|112 comments
60.
SecureDrop Leak Tool Produces a Massive Trove of Prison Docs(wired.com)
39 points by garrettr_ 11y ago|2 comments

More ›