maqp

42 ms·

451.
by maqp 6y ago
It's still one of the cheapest attacks after #1 is plugged with public key encryption or initial off-band (sneakernet) key delivery.
452.
by maqp 6y ago
" That's why I wrote "commitment scheme" of which there are many and which secure one you use doesn't really matter. " Please see https://en.wikipedia.org/wiki/Commitment_scheme It's
453.
by maqp 6y ago
There's other stuff protecting you when it comes to Signal: FOSS code, professional audits, reproducible builds etc. If you can't trust networked TCB there's not much you can do anyway. Adding one or more networked TCBs that
454.
by maqp 6y ago
The thing is, for the Horcrux to have any effect at all you need at least three devices per endpoint. And at that point using split TCB architecture is much better as under some assumptions it's provably secure against remote key exfil
455.
by maqp 6y ago
The most practical is to drop the information theoretical promises and use e.g. Linux kernel's GETRANDOM syscall. Or you can outsource the HWRNG building for users who can create it from COTS parts, e.g. http://holdenc.alter
456.
by maqp 6y ago
Then how are you addressing 1) the security of the individual endpoints with access to each share. Let's say your magic wand is airgapped and nothing gets in via the share transmission media (QR-code, thumbdrive, whatnot). What if your
457.
by maqp 6y ago
How are you ensuring a US-manufactured HWRNG produces random numbers -- i.e. how are you ensuring the NSA doesn't put HW implants to your devices as they're being delivered to your customers? https://arstechnica.com&#x2
458.
by maqp 6y ago
" To split them in such a way that different nation-state actors will each encounter significant expense is pretty brilliant. " That's where the concerns start. There's no data about which services are compromised by whi
459.
by maqp 6y ago
" It's true, but the way I describe the Magic Wand it doesn't have any data so not much to hack " For remote key/plaintext exfiltration, it's enough the plaintext message or private key is in the memory of the
460.
by maqp 6y ago
" it's not hard to add a hash to the messages that will be a commitment scheme to ensure that you have all horcruxes and they haven't been tampered with " Oh dear god. No, hashes aren't to provide authenticity and i
461.
by maqp 6y ago
" the threat model was looking at observing text, not changing it. " Encryption aims to provide not just confidentiality but also integrity and authenticity. Three guesses what the integrity means. " I haven't heard abou
462.
by maqp 6y ago
" Please chill out with the attacks " I'm not attacking you, just the concept. The goal is not to hurt you, but to protect others. Please don't take it personally! " What is TCB? " https://en.wikiped
463.
by maqp 6y ago
" We equally distrust all channels a bit " The problem is you're proposing a scheme that's completely insecure if all channels are being watched by the same entity. The fact you're not employing public key encryptio
464.
by maqp 6y ago
" Hyperbolic claims aside†, I think this is a practical way to dramatically increase the security of OTP key transmission over networked communication. " I get you, you're thinking, it's safe as long as one of the channe
465.
by maqp 6y ago
" Another argument for multiple services seems to be some implied DOS resistance. But of course exactly the opposite is true: if you split your message and deliver it via multiple channels, any one of those channels can be taken offlin
466.
by maqp 6y ago
Horcruxes are just a layer of security. Sure, but the problem it solves is not the problem that needs addressing. Ciphertext and key delivery can already be done safely with E2EE apps like Signal. Metadata can be eliminated with e.g. Tor
467.
by maqp 6y ago
The problem is the magic wand is a single endpoint which will also have 0-days now, and in the future. Since the endpoint is connected to the network (at least you don't talk about airgaps in your work), there's a bidirectional ma
468.
by maqp 6y ago
From the documentation: " Often the 0-days are targeting the most common platforms, so using a lesser used platform increases the attack cost linearly or superlinearly. " There's only so many platforms. The exploit would eith
469.
by maqp 6y ago
It's the vendor that should be releasing the clients with support for it. The fact it's a third party is both a problem and proof of huge internal problem.
470.
by maqp 6y ago
Ah yes, the classic hacking someone with their phone number!
471.
by maqp 6y ago
" I always took the claim of routing keys and messages in different jurisdiction to be about not writing them to storage in those jurisdiction, not about not having them in RAM." There's no precedent I'm aware of that if
472.
by maqp 6y ago
Schneier was very vocal after the Snowden documents on how the NSA has multiple methods to get hold of the data. If it's not via judicial means, it's via extra-judicial means. NSA considers Telegram's servers outside US fair
473.
by maqp 6y ago
If you have your closed-source app audited, everyone needs to trust the audit company. And I've seen some shit audits in my life that told absolutely nothing about the actual security. Open source means anyone can audit and verify noth
474.
by maqp 6y ago
The expectation of privacy loses it's meaning when the group size grows. It's more likely what you said remains private when you say it in a group of five people than if you say it in a group of 50, 500, 5000, or 500,000 people. I
475.
by maqp 6y ago
Theoretically, couldn't the client send the message to one server and the keys to a different set of servers? Clients would request the encrypted messages from one server and the keys from another? That would imply client-side encrypte
476.
by maqp 6y ago
Don't get me wrong, I'm not saying the E2EE encryption itself is flawed. I'm saying it's not being used at all by default. And I'm saying it's not possible to use it for groups or desktop clients. That's _
477.
by maqp 6y ago
So Pantalaimon is something that needs to be added and configured, how easy is it to fuck up this configuration and accidentally send a non-E2EE message? Is it a program you can forget to launch? Is it something that can crash and make the
478.
by maqp 6y ago
" I cannot verify this, but Telegram said years ago that they solved certain problems by routing keys and messages through different datacenters in different jurisdictions. " Firstly, there is no proof of this happening. I've
479.
by maqp 6y ago
It was internal alpha but whatever: https://community.signalusers.org/t/beta-feedback-for-the-up... The community forums are a wonderful place to follow the development BTW.
480.
by maqp 6y ago
Both sender and recipient need to have each other in contacts to message one another.

More ›