ljlolel

36 ms·

661.
by ljlolel 6y ago
Yea some queer bloggers are going to help me find a better name too since we don't want the association with what JKR is talking about these days This doesn't help but XORcrux would also work maybe
662.
by ljlolel 6y ago
email sent
663.
by ljlolel 6y ago
All good points, agreed with all. > Sometimes just the fact that two parties are communicating is valuable knowledge and this Horcrux mechanism actually makes that easier to detect as it occurs across multiple systems. Steganography can
664.
by ljlolel 6y ago
I don't follow.
665.
by ljlolel 6y ago
Chill out a bit... Like I said, Signal (and everything else) has the same exact vulnerability, it must since I'd be sending over Signal. And if it doesn't, then this attack wouldn't be possible.... The whole point of using th
666.
by ljlolel 6y ago
"by force" I mean force Signal to ship code to the end user to upload the private keys so they can give it to the government, as described in the doc.... Oh I see what you mean about modifying. Good point. That's not in the t
667.
by ljlolel 6y ago
Yes a few people suggested that. Note that I am maintaining ZERO infrastructure here (important! also since it can help prevent DOS!), so it doesn't cost me anything to send these. A lot of these messaging infrastructures are free to u
668.
by ljlolel 6y ago
It's a different threat model. All on one device would not gain any more security on 0-days over Signal. But it would avoid dragnets on your raw messages on the wire or in messengers that have cloud backups.
669.
by ljlolel 6y ago
> Proof of Concept Heh, that's funny, the threat model was looking at observing text, not changing it. I haven't heard about anybody making things tamper-proof from a government that has got your keys. Signal, of course if they
670.
by ljlolel 6y ago
> Proof of Concept Heh, that's funny, the documented threat model was looking at observing text, not changing it. I haven't heard about anybody making things tamper-proof from a government that has got your keys. With Signal, o
671.
by ljlolel 6y ago
Pleas read through the whole doc. In many places it describes how it increases the cost of device hacking using 0-days significantly. There are limited other solutions for this, whereas Horcruxes are cheap and easy to implement.
672.
by ljlolel 6y ago
Please read through the document. It clearly states in the Magic Wand section that it would be separate HW not with any wireless or wired connections including WiFi or BlueTooth.
673.
by ljlolel 6y ago
Notion free personal version let's you publish links publicly (just not be SEO). It's awesome! Way nicer than google docs.
674.
by ljlolel 6y ago
> [citation needed] This is from a security expert who looked at this and told me. Are you saying that nobody ever compiles their own Signal client? I think you're still missing one of the points: if you use a separate app, OS, and
675.
by ljlolel 6y ago
What is TCB? > What the world needs is less vague marketing language, and more concrete examples. Please chill out with the attacks, this is an idea I'm not selling anything. There's a multi-page doc describing it in detail, no
676.
by ljlolel 6y ago
> Please provide citations for currently known vulnerabilities of each of these, then. They have had 0-days before, and they will have 0-days in the future. Jeff Bezos was hacked by Saudi Arabia using a WhatsApp 0-day. It's a prop
677.
by ljlolel 6y ago
Let's be more creative here Josh :) Maybe not Signal, but there are multiple secure encrypted email clients which DO have programmatic access including ProtonMail, DeltaChat, and others which are under different jurisdictions around th
678.
by ljlolel 6y ago
I hear you and I agree I'd rather not be triggering that. I tried asking a few people and trying to come up with a different name and people didn't understand it as easily. Horcruxes give you an idea of what it's doing basica
679.
by ljlolel 6y ago
That's true. You could end up with bad Opsec and then accidentally download both Signal and Telegram on the same device, reducing (but not eliminating) security. Thanks I'll add this to vulnerabilities. You can mitigate that with
680.
by ljlolel 6y ago
I used those words, but if you understand how OTP/XOR works, they're both kind of OTP. They're both totally random 0's and 1's. Only putting them together (using simple XOR) makes them a message. The separate chann
681.
by ljlolel 6y ago
>OTP is sent over one of the two channels (or m of n). The lint is that the pad has effectively the same security as the message itself. Yes! Exactly, that's the brilliant part of this. There is symmetric trust (distrust really) of
682.
by ljlolel 6y ago
Horcruxes are just a layer of security. If you want to further encrypt (or do more steganography) on the messages then it is not hard to add that too depending on your threat model and paranoia level. Horcruxes provide a unique solution to
683.
by ljlolel 6y ago
It's true, but the way I describe the Magic Wand it doesn't have any data so not much to hack. It's also pretty simple, trivial, QR code and XOR code, so really easy to audit fuzz test and verify nothing fishy can happen. Goo
684.
by ljlolel 6y ago
Thanks for saying it's brilliant :) Yes, entropy and true randomness will be an issue. I can imagine manufacturing a Magic Wand (all in the US) which would be a custom piece of HW with an entropy chip (maybe using cosmic rays?) Yes you
685.
by ljlolel 6y ago
I added a section on Threat Models as examples
686.
by ljlolel 6y ago
OTP is not sent over the same channel. Is there some other way I can explain it better, maybe a specific section on a Threat Model (there's a vulnerabilities section to include things not in the threat model).
687.
by ljlolel 6y ago
Avoiding the mobile OS sandbox escape I mentioned in a few places, and you'd use multiple devices and OS's as described.
688.
by ljlolel 6y ago
Originally I had it as a Google Doc. That got 0 votes on HN. This is my second attempt. Super easy upgrade to Notion. I agree could be better, but further raising the bar to publishing might mean I never do it :(. Actually the feedback ab
689.
Horcrux Encrypted Messaging(notion.so)
77 points by ljlolel 6y ago|93 comments
690.
Horcrux Messaging: secret messages even the NSA can't read(docs.google.com)
2 points by ljlolel 6y ago|0 comments

More ›