ge0rg

30 ms·

271.
Quadrooter: New Vulnerabilities Affecting Over 900M Android Devices [pdf](checkpoint.com)
175 points by ge0rg 10y ago|124 comments
272.
by ge0rg 10y ago
It is a good practice to use key / certificate pinning for your API endpoints anyway, and there you can provide any trusted KeyStore you want...
273.
by ge0rg 10y ago
Your argument only shows how wide the field of "IoT" is. For embedded sensor networks, your arguments apply without restriction. However, for things like "smart lightbulbs" or other devices connected to the cloud (not th
274.
by ge0rg 10y ago
It also looks like XMPP is used in some home alarm systems [0]. Unfortunaltey, the developers there did too many things wrong, not only security-wise but also in how they used XMPP [1]. [0] http://www.heise.de/ct/artike
275.
by ge0rg 10y ago
Google is still using XMPP, but not officially for IM. Goodle Cloud Messaging (GCM)[0] comes to my mind, where you use XMPP to send notifications to your Android/ChromeOS/... clients. There is also Google Cloud Print [1], where XM
276.
by ge0rg 10y ago
Does that also work for the Android build? Sounds like an incentive to finally try out sync...
277.
Vector Android now also on F-Droid(matrix.org)
5 points by ge0rg 10y ago|2 comments
278.
by ge0rg 10y ago
Sorry, but an implementation is not a specification. It is not only much harder to read, but it is also a moving target. It is borderline impossible to make an independent implementation of the protocol this way. Besides, the fact that it i
279.
by ge0rg 10y ago
Now that the Signal Protocol is deployed in so many different places, is there a proper specification of the (current) protocol? (The old axolotl spec and the GPL implementation don't qualify) What are the licensing conditions / r
280.
by ge0rg 10y ago
Maybe because it scales far better than HTTP polling, and there are ready-made libraries for many platforms? XMPP is not just an IM protocol, it's also usable (and used) for machine-to-machine communication...
281.
XMPP IoT Anti-Patterns(geekplace.eu)
5 points by ge0rg 10y ago|4 comments
282.
by ge0rg 10y ago
The headline is pretty click-baity, the article outlines that Android OEMs are struggling and going the way of the PC OEMs a decade ago. While this is true, there are still PC OEMs now, and there is no evidence of the Android ecosystem coll
283.
by ge0rg 10y ago
Background for shutting down StartEncrypt: https://www.computest.nl/blog/startencrypt-considered-harmfu...
284.
by ge0rg 10y ago
Please be aware that you may not use this code to interact with OWS servers or in an app containing "signal" in the name [0]. [0] https://github.com/LibreSignal/LibreSignal/issues/37#issueco...
285.
by ge0rg 10y ago
Oh yes, I absolutely loved the Desire Z (the other ones didn't quite make it to the European market). Haptic feedback is really important, and the little bonus features like the OK button/trackpad/notification LED were a grea
286.
by ge0rg 10y ago
Turbo Vision. It was the most sophisticated text mode UI ever created, with a stunning love to the little details (at least in Turbo Pascal 7). Today it would still make sense for server applications, but the C++ port was rather horrible an
287.
Federation, Privacy, and User Experience(medium.com)
4 points by ge0rg 10y ago|0 comments
288.
by ge0rg 10y ago
It would be interesting to know how you do see Signal, then. After reading your comments on the LibreSignal tracker, my impression was that you are very much writing with your business hat on, as you are framing alternative clients as &quot
289.
by ge0rg 10y ago
It is a real pity that the lack of developers is compensated by splitting developer focus on two different forks. If the reasons stated are true, let's hope it works out and strengthens embedded Linux, maybe even leading to a reunion l
290.
by ge0rg 11y ago
I suppose the main reason is that it links to your existing Signal installation on iOS/Android, and does not work standalone.
291.
by ge0rg 11y ago
+1 for documentation. The XMPP community is trying to get "OMEMO"[0,1] rolled out, which is an XMPP adaptation of Axolotl, but fails due to missing specs[2]. [0] https://conversations.im/omemo/ [1] https:&#x
292.
by ge0rg 11y ago
But it had a significantly better signal-to-noise (SCNR) ratio when looking for specifications, code and docs. The original "axolotl" term comes from a completely different domain, so it was easy to distinguish and filter for. &qu
293.
by ge0rg 11y ago
There are two trust problems that verifiable builds are supposed to solve: 1. Did the authors manipulate the source code compared to what they published? 2. Did a third party manipulate the binaries on the distribution channel? The process
294.
by ge0rg 11y ago
Although the students could not see the key’s digits, they guessed at them by a repetitive process of changing a digit or a letter in the key and sending it back to the target phone. That sounds like a timing attack against the iMessage s
295.
by ge0rg 11y ago
n other words, Linux Kernel developers could sue because the GPL license terms aren't met, but Oracle couldn't sue because the CDDL license terms are being met. As Oracle has contributed to the Linux kernel as well, they are in
296.
by ge0rg 11y ago
Even with leasing, the used cars won't be immediately destroyed, so it's reasonable to assume they will be sold to people, and these people will have an interest in inexpensive maintenance and repair.
297.
by ge0rg 11y ago
It would be much more sincere if cloudflare wasn't also hosting DDoS-for-hire services [0]. While I can understand the "free speech" argument, it still has a funny smell. [0] http://krebsonsecurity.com/2014&#x
298.
by ge0rg 11y ago
By implementing ECDSA natively in assembler, he was able to speed up signing by 21x. Let's hope it is resistant to side-channel attacks[0] ;) [0] https://news.ycombinator.com/item?id=11223266
299.
by ge0rg 11y ago
Thanks for the clarification. While I am aware that Curve25519 is not Ed25519 is not ECDSA, they all at least belong into the field of Elliptic Curve Cryptography. It is hard for an outsider to tell how wide a certain sub-field is, and how
300.
by ge0rg 11y ago
I'm only a crypto hobbyist, so I haven't followed the field (side-channel attacks on ECC) too closely. Still, the authors themselves address ECC and not jus ECDSA in the related work section, and I considered Curve/Ed-25519 t

More ›