ge0rg

33 ms·

301.
by ge0rg 11y ago
I was not questioning the impact of their demonstration, which is really impressive. However, being responsible academics, they should have done their related work research. And when doing related work research on side-channel attacks again
302.
by ge0rg 11y ago
Please elaborate the downvotes. While not actually testing Curve25519 is perfectly valid for the authors, comepletly ignoring its existence is a bit far-fetched, as it is clearly in scope. To quote the first sentence of the paper: "We
303.
by ge0rg 11y ago
This is a really impressive piece of work. Unfortunately, the authors completely ignore Curve25519[0], which was designed by DJB (and implemented as NaCl[1]), with the goal to reduce side-channel vulnerabilities. From a random Curve25519 pr
304.
by ge0rg 11y ago
Yes, and the games you "buy" also shrink into nothingness if the distributor goes bankrupt or you are accused to violate somebody's ToS. I wish back for the physical distribution of game media and offline validation of serial
305.
by ge0rg 11y ago
Non PDF version rendered by github: https://github.com/rootkovska/state_harmful/blob/master/stat...
306.
by ge0rg 11y ago
Alice sends a message to Bob, her device asks the messaging service for Bob's account's identify and public keys. This is a classic trusted third party problem. We need to trust the service that the public key provided (and stor
307.
by ge0rg 11y ago
You can not get anonymous phones in all countries. In many places, sale or activation are bound to your personal details. Besides, a state-backed attacker will still be able to figure out at least the region where you bought / used the
308.
by ge0rg 11y ago
At least you should not. StartSSL (and probably other CAs) has a prominent feature to create your key pair for you, which you need to skip to use a signing request. Always use the latter!
309.
by ge0rg 11y ago
The differences are: * XMPP is using addresses with the same format as e-mail addresses (Jabber ID/JID), Signal accounts are bound to your phone number * Signal has strong end-to-end encryption built-in, for XMPP you need OTR or the re
310.
by ge0rg 11y ago
You are right. The XMPP Standards Foundation is currently preparing to create a list of "must-have" client and server XEPs for certain use cases, like Instant Messaging or IoT. This will hopefully make the path easier for future a
311.
by ge0rg 11y ago
Unfortunately it is not true. XEP-0280 [0] (Message Carbons; since 2010) forwards your conversation to all your online clients, and XEP-0313 [1] (Message Archive Management; since 2012, but only recently implemented) allows a client to &quo
312.
by ge0rg 11y ago
All these problems have been solved in XMPP years ago, and there are some clients fully supporting the mobile experience and usage of multiple clients. On the Desktop, Swift and Gajim come to my mind, on Android Conversations is getting re
313.
by ge0rg 11y ago
The downtime happens when you restart the server so it loads the new certificate. This must probably be addressed in the server implementation.
314.
by ge0rg 11y ago
Okay, so this tremendously complicated and secure ceremony is performed to essentially sign a "Verisign is allowed to do whatever they deem appropriate to the root of DNS in the next six months" certificate. This is really just se
315.
by ge0rg 11y ago
> Apps are no 99 cents. Anecdotal evidence here, but I have a successful app on Google Play (which is commonly viewed as a less-willing-to-pay audience) at 5$+, despite the fact that the app is FOSS and you can download the binary from t
316.
.IM TLD DNSSEC DLV DANE XMPP TLSA RR(op-co.de)
7 points by ge0rg 11y ago|0 comments
317.
by ge0rg 11y ago
Original article by Frederic Jacobs: https://gist.github.com/FredericJacobs/b1b518125b7066880359
318.
by ge0rg 11y ago
Maybe this is due to a lack of proper widget toolkits. Curses is a real pain to program, and creating sophisticated UIs with it is borderline impossible. Things like dialog are not very flexible, and TurboVision (the best looking CUI ever)
319.
Researchers reveal electronic car lock hack after 2year injunction by Volkswagen(arstechnica.com)
2 points by ge0rg 11y ago|0 comments
320.
by ge0rg 11y ago
While helper scripts for OpenSSLs arcane syntax are highly appreciated, running some .sh file downloaded from the Internet is not the wisest of security ideas. The author (or somebody from GitHub) could just replace this script with one tha
321.
by ge0rg 11y ago
Chapter 1: https://news.ycombinator.com/item?id=9526602 / https://medium.com/backchannel/the-view-from-the-front-seat-... tl;dr: most accidents with Google cars were caused by distracted human dri
322.
by ge0rg 11y ago
This is a really interesting idea. iBeacon is way too inflexible in what you can encode in it. I really dislike the decision to make it part of the Play API (as opposed to standard Android), as it ends up not being really open after all. I
323.
by ge0rg 11y ago
This is especially true when the compiler removes security-relevant range checks from the code because the developer used the wrong type / parameter order and thus caused UB.
324.
by ge0rg 11y ago
I really wonder about the practical and insurance implications of that: What happens if your phone crashes and the car keeps driving, despite the dead man's switch? What if you commit suicide by driving over yourself? What if somebody
325.
Land Rover develops a smartphone remote control for its SUVs(theverge.com)
1 points by ge0rg 11y ago|1 comments
326.
by ge0rg 11y ago
Apps you upload to iTunes Connect that contain bitcode will be compiled and linked on the App Store. Unless the description is wrong, this looks like Apple could insert any code they want into your binary, without your users noticing.
327.
by ge0rg 11y ago
But who will keep archives of pinboard? Seriously, this approach will only shift the data from one unreliable online service to another one. Having decentralized offline copies of relevant information is much better. And maybe we will be ab
328.
by ge0rg 11y ago
..and also to send SMS messages to premium numbers, at your expense!
329.
by ge0rg 11y ago
tl;dr: Android M replaces the "Permissions dialog" on app installation with runtime dialogs displayed when a sensitive permission (Camera, Microphone, personal data) is actually required by an app. This is a step into the right di
330.
Android M Preview Runtime Permissions(developer.android.com)
2 points by ge0rg 11y ago|3 comments

More ›