maqp

28 ms·

331.
by maqp 5y ago
Well the technology differs a bit. The NSA implant was a passive retroreflector implant, which when illuminated by powerful radio waves, broadcasted back what was being typed, or what was visible on screen. This seems to be more of a tiny c
332.
by maqp 5y ago
>half of the people in the comments are asking why they should trust them and rightfully so. Exactly. The problem isn't only "will they sell my data via B2B", or, "Do they hand out data to governments via classified p
333.
by maqp 5y ago
HP18 is pretty damn good. Few other fine experiences from over the years - Aberfeldy 12y - Powers John's Lane 12y - Glenfarclas 40y - Glen Garioch 1994 - Old Pulteney 21y - Old Pulteney 16y Bourbon Cask strength - Imperial 16y (Signato
334.
by maqp 5y ago
Hadn't really looked into SIV as I've only written stuff that always generates XChaCha nonces with getrandom but yeah I can totally see why the platform etc. could cause issues that lead to nonce-reuse. This was most informative p
335.
by maqp 5y ago
What @dagenix said. See e.g. Thomas Pornin's answer here https://crypto.stackexchange.com/a/3979 for more details
336.
by maqp 5y ago
So SHA224 and SHA384? They're not exactly common. SHA256 is pretty much the standard and SHA512 is usually used for hashing larger files due to the larger block size and thus faster speed. I don't think I've ever seen 224&#x2
337.
by maqp 5y ago
One aspect of security is also the misuse resistance. You can of course create a secure MAC with SHA256 in the HMAC configuration, but it usually takes a masters level course on cryptography to know what is Merkle-Damgård construction, and
338.
by maqp 5y ago
Platform support is one aspect, another is re-implementing the algorithm in constant time to prevent side channel leaks. Also perhaps the code was edited to be stable under different fuzzers. Note: this is all speculation and generalization
339.
by maqp 5y ago
>I have two mobile phones, one Android and one iOS Cool edge case. You can have two phone numbers too you know. > I use it to share data between computers You can always tell a shill when they try to advertise the product's featu
340.
by maqp 5y ago
>If security was really that important to Signal, where was the urgency there? If the cause is a random database key collision you can't immediately discover it obviously. You have no idea what was causing it, so you'd have to
341.
by maqp 5y ago
Would rolling into the beta help here? https://support.signal.org/hc/en-us/articles/360007318471-Si...
342.
by maqp 5y ago
Nah, easier to get them to Signal when a large portion of their peers is already there. Plus Signal's more secure than Delta-Chat that's not even forward secret, that isn't audited, and that's using 30 year old PGP.
343.
by maqp 5y ago
>As for the metadata, no metadata is leaked that signal does not also leak. Signal does not leak to third party servers with whom I talk to. There's encrypted comms to the server, and that's it. I try to talk to someone who has
344.
by maqp 5y ago
So let me see if I got this straight... You will never use an app that HAD 0.000000001% chance of outputting a file on your phone to wrong peer over 100% end-to-end encrypted channel... but... You knowingly use an app that leaks 100% of you
345.
by maqp 5y ago
They would have to compromise your client which is in no way different from compromising your device. The NSO / Pegasus systems do just that. They allow arbitrary command execution, which includes sending any file on your phone to any
346.
by maqp 5y ago
>I'd rather use a chat app that takes security matters seriously and urgently and will eventually have E2E. Deploying messaging app without E2EE being the first four chars on the security design paper -- even before the product name
347.
by maqp 5y ago
>are at least working on E2E So they're in the process of moving it from 1995 to 2004. That's great! If all you have on Signal is opt-in feature for payment, and an issue of usernames that's being worked on -- but you want
348.
by maqp 5y ago
>So? Isn't that the point though? Having regular audits should have caught this issue? I thought this being 'open source' this would made this even easier. You have it the wrong way. Testing, audits, and open source are al
349.
by maqp 5y ago
So what ingenious method should they have deployed to prevent all programming errors beforehand, and how should they have handled it? Advice users to fall-back to non E2EE SMS? The team deployed logging as fast as they could, successfully d
350.
by maqp 5y ago
>serious alternatives How is Quill Chat that's proprietary and not E2EE a serious alternative? Element's UX is behind Signal but at least the encryption is E2EE by default. Session is a Signal fork with bad metadata protection:
351.
by maqp 5y ago
Cool, my contacts can keep using their gmail account and leak all communication metadata to Google without me having any say on that if I want to talk to them. Where can I sign up?
352.
by maqp 5y ago
>by far the toughest messaging protocol to crack. Citation needed.
353.
by maqp 5y ago
>Yes. Signal's only selling point is privacy. Both of these bugs are huge privacy breaches that kill its value proposition. Absolutely agree. However, you should always look at the bigger picture a) How was the issue handled? What w
354.
by maqp 5y ago
No, contrary to common belief, coordinating with multiple client projects to release features simultaneously etc, is not easier. The number of meetings does not drop, the quality will not improve if you now have to check that multiple clien
355.
by maqp 5y ago
Finnish social welfare includes free medical/dental care and drugs. The social welfare and housing support total about 1200€ / month. So after bills, they have between 400-700€ / month for food, clothing etc. It's not an
356.
by maqp 5y ago
Ah, very good, thanks! So yeah, half of the chronically homeless. That's extremely bad news. But let's remember that doing drugs to forget your life has been a mess for a long time is not a lifestyle choice decision. There's
357.
by maqp 5y ago
Why do you need to compare the entire US? Only 20 states have more people than Finland does. Also, if Japan with its 125 MILLION people can have 0.3 homeless per 100k (about half of what we have in Finland) why can't California with 40
358.
by maqp 5y ago
The main reason it doesn't work in US is, you don't tax the rich and corporations like you should, and because your tax dollars are spent on inefficient massive military industrial, intelligence industrial, prison-industrial, and
359.
by maqp 5y ago
I'm sorry, where on that 23 page document does it say 50%? On Page 2 it says "On a given night in January 2010" -- "26.2% of all sheltered persons who were homeless had a severe mental illness" and "34.7% of al
360.
by maqp 5y ago
How much does a set of bullet proof window for a tiny one-bedroom apartment, and a security door cost? Guarded tent-site sounds like pouring truckloads of money to the sea.

More ›