lvh

70 ms·

691.
by lvh 8y ago
They might mean best-case vs average-case vs worst-case. A worst-case hash table insertion might be O(n) (rehashing the table) and in the malicious case it might even be O(n^2) (all table entries collide in a single linked list).
692.
by lvh 8y ago
This looks super neat, but only works on generated PDFs, not images, for now. While it uses imaging tricks to extract lines and table-like structures, it needs actual text (not images of text) to extract. So, there's an OCR step missin
693.
by lvh 8y ago
Sure, his rebuttal wasn’t either :)
694.
by lvh 8y ago
I can't believe I'm defending save-an-HTML-file-to-disk as a model, but, in their defense: their did say _download_, so you can't mess with the SRI hash. (I don't think this is a good idea, I'm just saying technical
695.
by lvh 8y ago
It's pretty decent for the WiFi use case, but you could actually do something cooler with a symmetric PAKE if your WiFi device had a display. Pick a short random password, copy it over to the client, do SPAKE2. You now have a unique, h
696.
by lvh 8y ago
Is there a particular reason to use a symmetric PAKE in this case? Is it somehow not a long-held password?
697.
by lvh 8y ago
Since you're not worried anymore about burning the server-side resources, you prevent the dictionary attack in this scenario with a punitively expensive KDF. (Note: I am not saying this is a good idea! It's OPAQUE but worse.)
698.
by lvh 8y ago
I'm really excited about PAKEs! But for a totally different reason. PAKEs are great for low-entropy secrets, but they don't have to be static: you can generate them on the fly too. Every time you have a human-mediated channel that
699.
by lvh 8y ago
This is technically true, but the UX for this is so horrendous it's hardly worth taking seriously. If people are willing to put up with bad UX we could instead use TLS client certificates, which are still _much better_ than saving a pa
700.
by lvh 8y ago
Because we started talking about FDE specifically?
701.
by lvh 8y ago
But that's IMAPS and SMTP submission. Is that for random hosts on the Internet (like my phone on LTE) to read/send e-mail?
702.
by lvh 8y ago
That (organizations) was in reference to state level actors, which is what GP was talking about. EDIT: removed bit about 993/587 because you're answering that elsewhere.
703.
by lvh 8y ago
> How many people have access to drives in us-east-2a? Do you know? Can you verify? AWS, like every non-clownshoes provider, is transparent about the security controls on its datacenters. It has those verified by independent third partie
704.
by lvh 8y ago
The only Helm EC2 instance I've seen listens on 587 and 993, which seems incongruent with that promise.
705.
by lvh 8y ago
I mean, sure? You can use encryption to get security and privacy features but "FDE" isn't it. FDE is more important for Helm but that's a problem of their own design: suddenly the e-mail is in a box in my kitchen and it&
706.
by lvh 8y ago
If that’s the case, why does it listen on IMAPS/993 and 587?
707.
by lvh 8y ago
Have you gotten any third party audits? Are you publishing the results?
708.
by lvh 8y ago
Hang on: are you suggesting cloud e-mail services don't use FDE?
709.
by lvh 8y ago
Like Spamhaus? Elsewhere in the thread, Giri says it uses a VPN connection. Is it TLS + something else? helm.garrytan.com:3333 for example responds with a self-signed localhost cert, not LE keys. IMAPS (still not sure why that’s there but I
710.
by lvh 8y ago
If the EC2 instance is just a proxy and not where your mail lives, why does it run IMAPS?
711.
by lvh 8y ago
I wasn't debating your point; I was pointing out how this service accomplishes it without tripping over that problem. FWIW: I'm not sure that's actually how it works.
712.
by lvh 8y ago
What else runs on that EC2 instance?
713.
by lvh 8y ago
Neat! Who's Privacy Labs, Inc?
714.
by lvh 8y ago
Doesn't Helm have RCE on the device at all times? Doesn't all e-mail come in on an EC2 instance, and go out over an EC2 instance?
715.
by lvh 8y ago
If I understand correctly, incoming e-mail actually goes to some EC2 host.
716.
by lvh 8y ago
Mind sharing your domain? I'd love to peek at what they do DNS-wise. lvh at latacora dot com if you don't just want to hand it to all of HN :) The e-mail in your profile is hosted by Google, which makes sense because it looks like
717.
by lvh 8y ago
If the thing you're going against is "corporate server controls your data", why is the answer "EC2 proxy we control"? It sounds like I have to trust that server just as much, and essentially you're telling me y
718.
by lvh 8y ago
I'm skeptical of this device, but don't follow your reasoning. One of the device's concerns is security and privacy -- what security or privacy am I giving up by giving my backups to Tarsnap?
719.
by lvh 8y ago
Well, shit: you're right. I do realize that Signal is open source, yes (and I'm guessing from your phrasing you know I know that), but I don't feel a moral imperative to source dive every time someone says something weird. Pu
720.
by lvh 8y ago
You know what makes you not stand out? WhatsApp.

More ›