maqp

6 ms·

31.
by maqp 6mo ago
and many LEDs are weak photo-diodes, i.e. you get weak current when you shine a light to them.
32.
by maqp 7mo ago
The sad part is, Instagram is exceptionally damaging to kids for a disjoint set of reasons.
33.
by maqp 8mo ago
A lot of bug fixing relies on some mental model about the code. It manifests as rapid "Oh 100% I know what's causing" -heureka moments. With generated code, that part's gone for good. The "black box written by a bla
34.
by maqp 8mo ago
>Loading your messages on Signal can take quite a while. Yeah if you have to go through hundreds of ratchet steps, yeah it will take time. That's expected. The only way to make it faster than that is to deploy it without privacy. Th
35.
by maqp 8mo ago
The server IPs are hard-coded into the Telegram client's source: https://github.com/DrKLO/Telegram/blob/d7deedfa33ddfa51c72a5... You know you can just run $ git clone https://github.com/D
36.
by maqp 8mo ago
Nice touch with the IP :D
37.
by maqp 8mo ago
The ratchets would have different state yes. The MITM would mix in different entropy into the keys' states. It's only detectable if the MITM ever stops. But since the identity key exfiltration only needs to happen once per lifetim
38.
by maqp 8mo ago
The real story is, MAX is there to scare people into Telegram. Durov isn't your friend, neither is Putin who doesn't bother blocking connections to the server. >So I wouldn't count on its E2EE either. This is the worst way
39.
by maqp 8mo ago
Yeah it's really hard to block tally count of five IPs. https://telegramplayground.github.io/pyrogram/faq/what-are-t... No wonder the great Russian firewall is struggling to keep TG at bay. Wake up.
40.
by maqp 8mo ago
No end-to-end encryption by default. WhatsApp has. No end-to-end encryption for groups. WhatsApp has. No end-to-end encryption on desktop. WhatsApp has. No break-in key-recovery. WhatsApp has. Inferring Telegram's security from public
41.
by maqp 8mo ago
>I know the default assumption with Telegram is that they can read all your messages The client is open source. It's trivial to verify this is 100% factually happening. They have access to every group message. Every desktop message.
42.
by maqp 8mo ago
Yeah Telegram only has 1:1 opt-in E2EE, that you can't use across your devices, so either you or your buddy quickly gets tired of whipping out their phone when they're sitting at their laptop, and just replies you through Telegram
43.
by maqp 8mo ago
>I don't really see how it's possible to mitigate client compromise. You could of course offload plaintext input and output along with cryptographic operations and key management to separate devices that interact with the netwo
44.
by maqp 8mo ago
Signal protocol prevents replay attacks as every message is encrypted with new key. Either it's next hash ratchet key, or next future secret key with new entropy mixed via next DH shared key. Private keys, probably not. WhatsApp is E2E
45.
by maqp 8mo ago
"Many forms of dynamic code loading, especially those that use remote sources, violate Google Play policies and may lead to a suspension of your app from Google Play." https://developer.android.com/privacy-and-secu
46.
by maqp 8mo ago
>Not that I trust Facebook or anything but wouldn’t a motivated investigator be able to find this key exfiltration “function” or code by now? Yeah I'd imagine it would have been found by know. Then again, who knows when they'd
47.
by maqp 8mo ago
No I said signing keys. If you're doing MITM all the time because there's no alternative path to route ciphertexts, you get to generate all those double-ratchet keys. And then you have a separate ratchet for the other peer in the
48.
by maqp 8mo ago
How are you hiding it from IDA pro though?
49.
by maqp 8mo ago
Nice! Hey, question: I noticed Signal at one point had same address on Google Play Store as WA. Can you tell us if Signal devs shared office space with WA during integration of the Signal protocol? Related to that, did they hold WA devs&#x2
50.
by maqp 8mo ago
Well the thing is, the key exfiltration code would probably reside outside the TCB. Not particularly hard to have some function grab the signing keys, and send them to the server. Then you can impersonate as the user in MITM. That exfiltrat
51.
by maqp 9mo ago
thanks I'll have to test this out!
52.
by maqp 9mo ago
2027: OpenAI Skynet - "Robots help us everywhere, It's coming to your door"
53.
by maqp 9mo ago
Something that wasn't mentioned in the article - if you're coming from Windows and using Foobar2000, you'll want DeadBeeF https://deadbeef.sourceforge.io/
54.
by maqp 9mo ago
> at least telegram is fast Telegram is fast precisely because it's backdoored by design. Forward secret messaging app with proper key management has to encrypt the message to every peer in the group. Telegram can just use single pa
55.
by maqp 9mo ago
Yup, yet for some reason we see Telegram always pushed on secure messaging app chats, up until the point when someone points out it's not secure at all like it tries to advertise it self. Then it's always about the fun features it
56.
by maqp 9mo ago
>Telegram can make it work because they do have it if you switch it on per chat You can't enable 1:1 secret chat from your desktop client. The secret chat doesn't appear on desktop when you enable it on your phone. So you'
57.
by maqp 9mo ago
The OTRv4 project is apparently dead. The last commit from Celi was four years ago https://github.com/otrv4/otrv4
58.
by maqp 9mo ago
>working on all devices makes it very nice. Signal has end-to-end encryption working on all devices. Telegram doesn't because they're amateurs.
59.
by maqp 9mo ago
>If you want people to switch, recommend Telegram. Why would people switch from always-end-to-end encrypted group chats to never-end-to-end encrypted group chats?
60.
by maqp 9mo ago
>joined Telegram on their own because of its benefits Sorry, social media masquerading as a secure messaging app isn't a secure messaging app.

More ›