ge0rg

41 ms·

391.
by ge0rg 13y ago
You should never leave a sensitive device like your laptop unattended. A sophisticated attacker can replace your bootloader with a backdoored version that stores the encryption paraphrase to disk in plain.
392.
by ge0rg 13y ago
I would add one thing to the list though: the PIN is stored as part of the data, instead of being used as the basis of an encryption key. With PBKDF2 and the option to supply longer PINs/passphrases, this can improve security by anothe
393.
by ge0rg 13y ago
That article is behind a paywall.
394.
by ge0rg 13y ago
You would be right if the telegram developers haven't started with ridiculous security claims ("military-grade", "unbreakable"). Their marketing implies you can use telegram for sensitive communication, which in pra
395.
by ge0rg 13y ago
tl;dr: if a geolocation is sent via telegram "secret chat" (end-to-end encrypted), the telegram android app will use clear-text google maps api to display the map, thus revealing the location to passive adversaries. according to a
396.
by ge0rg 13y ago
On http://vk.com/wall-52630202_7858 Pavel Durov writes that the finder of this vulnerability will receive a reward of $100k, and that comparable awards will be given for other findings. It looks like they are slowly making
397.
by ge0rg 13y ago
Not sure if the VK post was edited later on, but you are missing the other important statements by Pavel: * There was no data leak, the vulnerability is fixed, there is no danger. * It was a good idea to open the source and protocol for re
398.
by ge0rg 13y ago
That article is merely one piece of information in a long chain (Echelon, the Snowden revelations, Lavabit), and all of them add up to the conclusion that you better not trust any US-based/originated IT security system.
399.
by ge0rg 13y ago
tl;dr: moxie uses ancient, known broken crypto primitives (Dual_EC_DRBG, RSA with 896 bits, MD2 and XOR) to construct a chat protocol which is unbreakable if framed in the same way the Telegram developers did with their challenge. "If
400.
by ge0rg 13y ago
Haha, this is a nice try :D
401.
by ge0rg 13y ago
Also, credit card numbers do expire. You could just make a backup copy of somebody's private key and wait a year or two before transferring all their funds to your account, unless they move the money away to a different address themsel
402.
by ge0rg 13y ago
I wonder how long it takes for admins at VPS hosting providers to start harvesting private keys from VPS instances, using this tool or, where available, direct filesystem access...
403.
by ge0rg 13y ago
But in the real world,your contacts never told you "feel free to upload my name and all my phone numbers wherever you want, so we can be linked by some cloud service to improve their click-through rates". An app that uploads your
404.
by ge0rg 13y ago
Only open-source apps on open-source operating systems [..] ...running on Open Source hardware. Many modern smartphones employ a baseband processor and an application processor with shared memory. While the app processor might be running
405.
by ge0rg 13y ago
naturally, after receiving permission to do so. This is not quite true. I never gave anyone (especially not the users of WhatsApp or Telegram) permission to upload my personal information to any cloud services. You can not actually imply
406.
by ge0rg 13y ago
I am not quite sure how the dimensioning of the bloom filter affects the false positive probability. Of course it is easy to iterate through many phone numbers, but at least you can not know for sure if a probed number is actually in the fi
407.
by ge0rg 13y ago
Sorry, but this is just a lame excuse. There is no need to upload the personal names for this feature. Also, there are approaches to make number registration lookups more secure, e.g. bloom filters: http://en.wikipedia.org/w
408.
by ge0rg 13y ago
I have not run the app, but from the Android source code it looks like this "secure" app is uploading your contacts including full names and all their phone numbers into the "cloud": MessagesController.readContacts() [0]
409.
by ge0rg 13y ago
It is a really bad idea to compromise security for speed and connection stability. Processing power is a question of scaling the hardware, communication speed is hardly affected by a proper encryption scheme, neither is reliability of the a
410.
by ge0rg 13y ago
but it is almost unusable on ios because it can not run in background Unfortunately, the only way around that is to integrate with Apple's Push Service, which means you need to run a server-side component which notifies Apple (and wh
411.
by ge0rg 13y ago
An "encrypted communications app" that is not using secure encryption is worse than an unencrypted one - the users get a fake feeling of security, and might reveal sensitive information to whoever is listening. Regarding real secu
412.
Full Disclosure: The Internet Dark Age [pdf](politaia.org)
40 points by ge0rg 13y ago|18 comments
413.
by ge0rg 13y ago
The funny thing here is, Android had no choice to do it properly, because the respective "ask the user" mechanisms in Java, though present, are patented by Oracle, and the Android developers had to find an alternative mechanism to
414.
by ge0rg 13y ago
What bothers me most about this is not the caller's privacy (he chose to upload his photo into a public profile after all), but the called person's. The called Android phone has to obtain the "correct" photo in some way.
415.
Google will soon display your Google+ photo when you call an Android phone(engadget.com)
4 points by ge0rg 13y ago|1 comments
416.
by ge0rg 13y ago
Wow, this one got completely ignored on HN. I tend to believe Appelbaum, but without further evidence it will be hard to convince anybody of anything, and with BEAST still around, people do not dare switching to Aes-cbc, making the situatio
417.
by ge0rg 13y ago
Yes and no. You can trace every transaction back to day 0, so it is possible to know which other bitcoin wallet(s) the money was transferred to. If the thief however only uses the stolen BTC to pay for non-identifying services (i.e. interne
418.
by ge0rg 13y ago
To really run a CPU hot, you need to manually create a workload that utilizes all of the computation units (ALU, FPU, SIMD) interleaving assembler commands. This is nontrivial, and will not happen "by accident" when doing aggressi
419.
by ge0rg 13y ago
Do you have reason to believe that by running code at twice the speed, the energy consumption will be higher? IMHO this will be absolutely compensated for by being able to switch into a low-power state earlier.
420.
by ge0rg 13y ago
I would really like to know on which devices the host emulation API will be available at all.

More ›