ge0rg

22 ms·

211.
by ge0rg 9y ago
Primary source: https://github.com/stamparm/EternalRocks/blob/master/README....
212.
by ge0rg 9y ago
NVidia seems to produce excellent software (drivers, tools and SDK) for their excellent hardware. Here is a different perspective: https://googleprojectzero.blogspot.com/2017/02/attacking-win... And "excel
213.
Keylogger in Hewlett-Packard Audio Driver(modzero.ch)
492 points by ge0rg 9y ago|116 comments
214.
by ge0rg 10y ago
I actually prefer the ZWJ approach to just randomly combining multiple symbols into one, like with the country flags. With ZWJ you at least have a chance to reliably detect such a combined grapheme, as opposed to keeping long lists of speci
215.
by ge0rg 10y ago
I've gone through exactly the same discovery process when implementing faux stamps (something between images and Emoji) in my xmpp app yesterday. My idea was to increase the font size of a message that only consists of Emoji, depending
216.
by ge0rg 10y ago
This article provides a discussion of the incentive models of different chat systems (WhatsApp / Facebook, Signal, XMPP). It also compares centralized and federated approaches, their threat model and how future-proof they are.
217.
Have you considered the alternative?(homebrewserver.club)
13 points by ge0rg 10y ago|2 comments
218.
by ge0rg 10y ago
Probably not, the timing is too tight, and if Apple were aware of active exploitation, they would probably compeltely remove / block affected apps, instead of giving the devs a notice to improve the next release.
219.
by ge0rg 10y ago
Poland has the highest reading I wondered so as well, but the second-highest was from Spain, and I struggle to form a consistent picture from that.
220.
Detection of radioactive iodine at trace levels in Europe in January 2017(irsn.fr)
308 points by ge0rg 10y ago|87 comments
221.
by ge0rg 10y ago
It took me several paragraphs of wondering how they circumvented the iOS restriction until I realized that. They really should have added "Mac" to the title.
222.
CVE-2017-5589+ Multiple XMPP Clients User Impersonation Vulnerability(rt-solutions.de)
5 points by ge0rg 10y ago|1 comments
223.
by ge0rg 10y ago
Tl;dr: Wire voice and video chats use SRTP encryption, but the key is transmitted over the Wire server using normal TLS without further authentication checks or Certificate Pinning. A Wire employee or malicious government could MitM the cla
224.
How to intercept all Wire voice and video calls(medium.com)
58 points by ge0rg 10y ago|10 comments
225.
by ge0rg 10y ago
Are these client bugs? Most probably yes, you should report such things to the issue tracker at https://github.com/ChatSecure/ChatSecure-iOS Do they have a suite that I can run against my own server? The compliance
226.
by ge0rg 10y ago
The correct URL is of course https://conversations.im
227.
by ge0rg 10y ago
Congratulations! It's nice to see that we now have both Android (https:/mconversations.im) and iOS covered by usable and secure XMPP clients!
228.
by ge0rg 10y ago
Actually, XMPP has a solution for that for a year now [0]. The principal idea is that a client developer runs a push proxy component that forwards XMPP push events to GCM / APNS / whatever. The client tells its server which push c
229.
by ge0rg 10y ago
In 2013, the xmpp community decided to enforce TLS on all server-to-server links [0]. Google still doesn't support this, essentially preventing non-gmail users to communicate with them. While OTR is a possible solution, it has its own
230.
by ge0rg 10y ago
Signal requires users' phone numbers. True for Signal. XMPP is using JIDs which are functionally comparable to email addresses, and similarly anonymous (or not). Is there a way to run your own Signal server? The Signal client is op
231.
by ge0rg 10y ago
There are attempts at creating an XMPP compliance suite[0], but the biggest problem is actually a lack of volunteers / money to improve the clients and servers. Conversations is driven by one full time developer, most other application
232.
by ge0rg 10y ago
The context of the discussion ("Easy XMPP") is an attempt to fix the UX of XMPP clients, which starts with a set of small steps documented in the pages linked from https://wiki.xmpp.org/web/Easy_XMPP
233.
by ge0rg 10y ago
but an instant messaging client is something pretty simple that it doesn't take hundreds or thousands of engineers to get right and make into a good product. While you are technically right, making a good (as in "usable") c
234.
IT Security Lessons from Fairy Tales(op-co.de)
10 points by ge0rg 10y ago|0 comments
235.
by ge0rg 10y ago
Conversations (mentioned in a different sub-thread) is a nice example of a niche instant messenger focusing on good UX. It is not only standards-compliant, but the author is actively contributing XMPP extensions, moving forward the state of
236.
by ge0rg 10y ago
or at least RFC 3921 RFC 3921 was superceded by RFC 6121 in 2011. You might want to update your facts before you criticize the protocol. The message routing rules leave many things to the server implementation, adding a bit of fuzzyness,
237.
by ge0rg 10y ago
Train somebody long enough to ignore those warnings and you’ve essentially made End-to-End-Encryption completely useless. Encryption without verification is ineffective. Opportunistic encryption (without authentication) is still a very
238.
by ge0rg 10y ago
I was looking for a web view of the demo zip, so I could see what it does without uploading or downloading files.
239.
by ge0rg 10y ago
Very interesting approach. Could you please provide a hosted version of the demo, that can be viewed on mobile clients?
240.
by ge0rg 10y ago
Do you have a better source for that? In the article it rather reads like the control system was at the receiving end: The systems that were attacked tried to respond to the attack by rebooting the main control circuit.

More ›