maqp

40 ms·

391.
by maqp 5y ago
Saying the database is encrypted when the database key has to sit in the RAM of the server is as disingenuous as saying this is proper way to lock up gems: https://i.imgur.com/0gBOPoQ.png You're basically arguing that
392.
by maqp 5y ago
>forgot that WhatsApp uploaded backups unencrypted to Google and/or iCloud. This might finally get fixed: https://www.theverge.com/2021/7/16/22580800/icloud-google-dr... Great news because it dis
393.
by maqp 5y ago
>leaves people who only read the titles with the feeling that Telegram encryption is vulnerable to attacks. I agree with you these attacks are not so severe the completely broke Telegram. But it is living proof Telegram authors don'
394.
by maqp 5y ago
Oh apologies, I didn't want to be gender exclusive here.
395.
by maqp 5y ago
>The features is has are NOT possible with e2e. Which feature? >clearly explained in their FAQ why they made it. They absolutely did not. >How come no other messenger simply copies telegrams feature but with e2e? Which feature isn&
396.
by maqp 5y ago
With Russia? No it's just useful to remember Durov's background, and since he's Russian, there aren't many countries he'd be secretly collaborating with. When the vendor is intentionally collecting and defending the
397.
by maqp 5y ago
>A 0.0001% chance that a Facebook product has backdoors to spy on people? Yeah, I have never ever heard anyone MITM attacked WA user, and I have never seen any claims the app leaks plaintext data or keys to server or third parties. If yo
398.
by maqp 5y ago
"It has severe drawbacks if you use e2e. The default is without because that's what most people want." I would suspect majority of users would disagree with the question "are you ok with Telegram keeping a plaintext copy
399.
by maqp 5y ago
It's true iMessage is not safe from such attacks, but you don't have to look further than Signal to see it's possible to create multi-device E2EE with seamless sync. iMessage and its bad design can only serve the function of
400.
by maqp 5y ago
Whataboutism. Also, 1) you generally don't need end-to-end encryption with people you're afraid to share your phone number to, and 2) Signal is already working on usernames.
401.
by maqp 5y ago
But that's just the thing now is it. It's NOT secure, that's the problem. * It leaks 100% of messages to server by default. * It leaks 100% of Win/Linux desktop chats with no chance to opt out * It leaks 100% of group me
402.
by maqp 5y ago
>Telegram doesn’t make money, or at least it doesn’t generate revenues, as of 2019. Durov pointed out on a blog post that he “believes in fast and secure messaging that is also 100% free.” Durov might as well be paying lip service here.
403.
by maqp 5y ago
You make this idiotic assumption that chat companies are MITM attacking users. Sure, the only way to be sure there is no MITM is to check the fingerprints. But that's aching to false dichotomy. You're not actually choosing between
404.
by maqp 5y ago
Were you in the academia, you'd know Telegram should've hired a cryptographer when they started, almost a decade ago. They have never done that, because to them pride is more important than doing things right. You, an academic, sp
405.
by maqp 5y ago
>The lead Telegram dev is a 3x International Math Olympiad gold medalist The lead dev * doesn't have ANY qualifications as a cryptographer (he got his position through nothing other than nepotism) and thus * thought AES-IGE was best
406.
by maqp 5y ago
It's tiring to see people claim Telegram is Secure e.g. "because it hasn't been hacked yet" :D These people don't realize Telegram is front doored by design, it leaks 100% of your chats to Mark Zuckerberg of Russia,
407.
by maqp 5y ago
>Telegram is fast It's fast because it's insecure. Would they deploy end-to-end encryption for their groups, it would be as slow as the competition. >has native clients instead of a garbage web ui The "native clients&qu
408.
by maqp 5y ago
>I have no idea what the fuck "counting grains in the bags of sound" is supposed to mean.' They have been doing this since the beginning. Their strategy of downplaying every attack against their protocol serves to mask the
409.
by maqp 5y ago
> Well, calling it "unencrypted" is equally misleading Encryption implies it protects message content from third parties. Show me someone who agrees its bad if the third party is some random guy from ISP, but it's good if
410.
by maqp 5y ago
>You have to choose between something you can use from whatever device you want You're being disingenuous. End-to-end encrypting every 1:1 chat by default, as well as end-to-end encrypting <1000 member groups have already been sh
411.
by maqp 5y ago
Here's the thing. There's perhaps a 0.0001% chance that iMessage or WhatsApp contains a backdoor that does not really encrypt a message. There's a 100% chance that every cloud message, every Windows/Linux desktop message
412.
by maqp 5y ago
"These days RSA is only used in digital signatures (which are not encryption)" AFAIK digital signatures are created by encrypting the hash of the plaintext (be it content ofthe certificate or a message or whatnot). But yeah, RSA i
413.
by maqp 5y ago
I'm not talking about XSS vulnerabilities, but having to trust the vendor to do the right thing every time I use it. Some companies can be coerced, internally compromised, and TLS and X.509 isn't exactly designed to be safe agains
414.
by maqp 5y ago
Yeah there are hacks around the problem, even JS application could be downloaded to a VM that is airgapped and the sate of which is saved, and after auditing the minified code (painful as hell) you know you can trust it on consecutive runs.
415.
by maqp 5y ago
"This is for signing a document with a "hand" signature, not cryptographically signing it with a cryptographic signature. " Ah very well, then it's not as important. "Besides, if you don't trust in-browser
416.
by maqp 5y ago
The P5 suffer from a disgusting design flaw: Under the magnetically connected ear pads, the headphones have a soft fiber-like material that's glued in. The glue will melt and leak between the contact points in a few months, which will
417.
by maqp 5y ago
If I'm reading this right it's in-browser JS signing software. The author makes the claim that native software is hard to audit, but neglects the much bigger problem of having to verify the JS downloaded on-demand for every sessio
418.
by maqp 5y ago
AFAIK TLS doesn't make such attempts simply because that would make it quite inefficient. However, if you're using Tor (like you probably should if you want privacy for online browsing) the exit-node that fetches the site for you
419.
by maqp 6y ago
Good read. Formalizes what Fox News etc. do to everything they spout out.
420.
by maqp 6y ago
"Important: Keyboards and IME’s can ignore Android’s Incognito Keyboard flag. This Android system flag is a best effort, not a guarantee. It’s important to use a keyboard or IME that you trust. Signal cannot detect or prevent malware o

More ›