handsomeransoms

12 ms·

61.
by handsomeransoms 13y ago
Yeah - looks like it's emulating a lock so only one page can be rendered at a time (plus the overhead for database IO to maintain the lock). Is this really the best way to go about this?
62.
by handsomeransoms 13y ago
Firebug is known to not work (and cause stability problems) at the moment (for reasons mentioned by cpeterso). We're working with addon developers to improve this situation.
63.
by handsomeransoms 13y ago
A little while back, somebody a cool demo of ultrasonic networking (using HTML5 Web Audio!) http://smus.com/ultrasonic-networking/
64.
by handsomeransoms 13y ago
One example is Bananaphone [0], which is designed to help Tor traffic look more like normal traffic to evade DPI. [0] https://lists.torproject.org/pipermail/tor-dev/2013-November...
65.
by handsomeransoms 13y ago
It's extravagant, and doesn't provide meaningful security. How much do you pay the armed guards that stand watch over your laptop 24/7? "Using encryption on the Internet is the equivalent of arranging an armored car to d
66.
by handsomeransoms 13y ago
telnet port 80 or bust
67.
by handsomeransoms 13y ago
If php.net used CSP, they would have been able to mitigate this attack with the frame-src directive [1]. [1] http://www.w3.org/TR/CSP/#frame-src
68.
by handsomeransoms 13y ago
According to the New Yorker, they received the documents but did not respond because they mistook them for input generated by their own internal tests. See [1], linked from [2] [1] http://homes.cs.washington.edu/~aczeskis&#x
69.
by handsomeransoms 13y ago
They still end up in the general bucket. At the moment, the design is such that there is a single "master" public key for each Securedrop installation that all submissions are encrypted with. The journalists are advised to downloa
70.
by handsomeransoms 13y ago
Pull requests welcome! (speaking as a contributor to the project)
71.
by handsomeransoms 13y ago
I appreciate your detailed response! I should not have been so dismissive of those users. Still, I maintain that the "extra cost for a dedicated IP" is a poor excuse for not implementing SSL.
72.
by handsomeransoms 13y ago
Fun fact about Startcom (providers of StartSSL): they were the only certificate authority that the "Comodohacker" responsible for breaching Comodo, Diginotar, and others, was unable to hack. [1] [1] http://www.informati
73.
by handsomeransoms 13y ago
Webfaction enabled SNI on all of their servers in December 2011 [1], which means you no longer need to buy a dedicated IP address to use SSL. In fact, when they made this switch, they switched my server over to SNI automatically and stopp
74.
by handsomeransoms 13y ago
Two concerns: 1. Your security model is identical to that of Lavabit, and is equally vulnerable to you being legally compelled (and kept quiet with a gag order) to collect your user's passwords. What is your threat model? 2. On your &q
75.
by handsomeransoms 13y ago
It's also their only naval base in the Middle East: http://en.wikipedia.org/wiki/Russian_naval_facility_in_Tartu...
76.
by handsomeransoms 13y ago
If you are concerned about leaking your associations via public key signatures, you could use (and request that your contacts use) local/non-exportable signatures. That way you will be able to keep track of your trusted keys locally, b
77.
Mozilla Security Blog: New Security Logging in Firefox DevTools(blog.mozilla.org)
3 points by handsomeransoms 13y ago|1 comments
78.
by handsomeransoms 13y ago
Unrelated to the content of your post, but your website has mixed content (which is blocked by Firefox 23): [13:47:59.462] Blocked loading mixed active content " http://openwhispersystems.disqus.com/embed.js" @ ht
79.
by handsomeransoms 13y ago
You could smash the drives that store individual's private keys, but beyond that - that's one of the benefits of a truly decentralized system.
80.
by handsomeransoms 13y ago
This is not entertaining (or, reading into subtext, absurd) at all. It is widely accepted that complete physical destruction of hard drives is required to avoid future forensic recovery, which is what Rusbridger is referring to when he ment
81.
by handsomeransoms 13y ago
"Practical Cryptography", by Bruce Schneier and Niels Ferguson, is meant to atone for the unfortunate real-world consequences of Applied Cryptography. It is comprehensive and good for people with basic discrete mathematics underst
82.
by handsomeransoms 13y ago
I wonder how effective this advice would even be at achieving that goal. Consider, for instance, that what meager protections are afforded electronic communications (by the Stored Communications Act, etc.) only apply to providers that &quot
83.
by handsomeransoms 13y ago
The long history of the interactions between relatively slow-moving governments and relatively fast-moving technology suggests that we should only legislate software as a last resort. One of the nice things about the proposed Do Not Track s
84.
by handsomeransoms 13y ago
Indeed - in fact, one little-discussed concern over 3rd-party cookie blocking is whether it would consolidate the power to track users into the hands of a few already powerful online companies (Google, Facebook, anybody that serves cookies
85.
by handsomeransoms 13y ago
This is one of the worst pieces of tech/business journalism I have ever had the misfortune to read. The overwhelming desire to paint Jonathan Mayer as David to the digital advertising industry's Goliath completely distorts the rea
86.
by handsomeransoms 13y ago
Jim Kent famously wrote GigAssembler, the breakthrough program that allowed the publicly funded Human Genome Project to successfully assemble the full human genome just 1 day ahead of their corporate competitor Celera, in 2000 while pursuin
87.
by handsomeransoms 13y ago
Good point. At some point, you'll need to communicate the onion address over a trusted channel. If you trust SSL, then you can serve the landing page over HTTPS, or as others have suggested, you could print the address in the New Yorker its
88.
by handsomeransoms 13y ago
Your confusing the issues of anonymization and eavesdropping. Tor exit nodes can eavesdrop on unencrypted Tor traffic, so you should always use end-to-end encryption if that is a concern. Tor Hidden Services don't need SSL because the proto
89.
by handsomeransoms 14y ago
/dev/urandom is supposed to provide cryptographic quality randomness. /dev/random does provide "better" randomness, in a sense, but may be blocking - it is typically used for the generation of long-term cryptographic keys (like GPG keys).
90.
by handsomeransoms 14y ago
Silk Road is very interesting from a design perspective, particularly the way it leverages different open source cryptographic tools to satisfy its complex security/privacy/anonymity requirements. I gave a talk about this at the Oakland Cry

More ›