maqp

53 ms·

571.
by maqp 6y ago
Also, - Telegram does NOT support E2E encryption for group chats on any platform. - Telegram does not use E2E encryption for ANYTHING by default.
572.
by maqp 6y ago
>But a bad crypto implementation will work. For all intents and purposes, it will appear completely fine. Users will get their messages. The bitstream will appear completely random. At least, until somebody with expertise in breaking cry
573.
by maqp 6y ago
>In the case of Telegram, the company defends its protocol saying that it’s been created by people with PhD in mathematics (which is related to and is foundational for, but different from, cryptography). It was created by Nikolai Durov w
574.
by maqp 6y ago
"Telegram does log chats server-side if you want them to" No. Telegram forces you to log all Windows / Linux desktop client chats and all group chats to their server. You don't have a choice with those. Also all chats in
575.
by maqp 7y ago
The problems here are searchability, padding to hide sensitive file size, and having to move large containers back and forth to make small edits. If the remote backup is designed around a proper client-side encrypting product, you can have
576.
by maqp 7y ago
The abuse penalizing part is rarely proportional to the income of the company. When the penalty, if you get caught, is just a slap on the wrist, it makes sense to just count is as a fee for making business.
577.
by maqp 7y ago
>I always found it kinda fishy if the party you're trying to protect against also provides the tools you use to protect yourself. It actually makes perfect sense the company would want to provide the tools that protect you from them
578.
Ocarina Of Time on Unreal Engine 4 – 100% Walkthrough 1h33m45s(youtube.com)
2 points by maqp 7y ago|0 comments
579.
by maqp 7y ago
You're right of course. We we should have a preferred order. Let's define conditions as something common like group chat. Let's also define backdoor as something that allows any non-group member to read the messages. 1. Signa
580.
by maqp 7y ago
Under what threat model?
581.
by maqp 7y ago
>I think part of the problem is that school and college teach us to say "no" to something that's not always true It's mostly that we fail to frame the context of the statement when it's true and when it isn'
582.
by maqp 7y ago
The point isn't hashes anonymize you, the point is you're already leaking IP in most cases, so phone number doesn't really reveal anything additional.
583.
by maqp 7y ago
>Now, by downloading and decrypting it on another device, you are adding a THIRD end where is is accessible You're not thinking straight. End-to-end encryption does not refer to two devices, it refers to two parties. If you have two
584.
by maqp 7y ago
Tox doesn't torify by default.
585.
by maqp 7y ago
>because only they have the private key to do so So when the system that contains the key is hacked and the key is exfiltrated? Or if an insider steals or leaks the key? The effin NSA couldn't keep their most well guarded secrets fr
586.
by maqp 7y ago
My intention was not to be confrontational. But such posts spreading misinformation aren't really thoughtful and shouldn't be tolerated. The standard method to detect MITM attacks from server side is with public key fingerprints.
587.
by maqp 7y ago
I'm not an expert on cryptocurrency so I can't say how well you managed to anonymize the paytrail but the problem of logs and the lifetime of the chain concerns me. When you start to chain VPN nodes you gain latency so you might a
588.
by maqp 7y ago
>There are no technical measures for Signal in place that allow anyone to verify the build all ends of said end-to-end encryption There is no technical measure in existence that allows that for any application. This is called a nirvana f
589.
by maqp 7y ago
That system a) has a paytrail, b) involves companies that can be coerced / hacked with relative ease, c) is a paid system and d) is quite a bit for average user to handle. Also, if you're going to stay anonymous, you need somethin
590.
by maqp 7y ago
These are called in-line encryption systems. They're generally not apps, but separate devices with automated ciphertext transmission. I've been working on something that does this http://github.com/maqp/tfc a
591.
by maqp 7y ago
Some messaging apps like Pidgin provide API for message input and output via some IPC like dbus.
592.
by maqp 7y ago
Does it alert you when your contact's key changes? Does it alert you when your contact buys another iDevice and installs iMessage on it? Thought so. That's where the attack happens, when you receive a new public key for contact&#x
593.
by maqp 7y ago
And for a very good reason. They're also offering the APK for those that need it, and they might make it more accessible e.g. for US users if EARN IT passes.
594.
by maqp 7y ago
There's also a targeted attack that allows arbitrary keys to be linked to your keyring to DoS you.
595.
by maqp 7y ago
The first case might be true (at least until homomorphic encryption matures), but client-side encrypted cloud backups are already a thing, e.g. Signal is working on it: https://signal.org/blog/secure-value-recovery&#x2F
596.
by maqp 7y ago
Its funny and sad that telegram developers at the same time dismiss their own past history of security vulnerabilities with "all programs have bugs", but then they attack an app with superior encryption protocol by complaining abo
597.
by maqp 7y ago
And those messages are the ones that reveal your intention to hide messages. That metadata is some of the most valuable. Also, people don't really want to use secret chats because they aren't cross platform. Sure, some people only
598.
by maqp 7y ago
>Again, that whole point of end-to-end encryption that allows it to eliminate the need to trust the vendor only works if the vendor isn't the one supplying said end-to-end encryption. That doesn't make any sense whatsoever. Ven
599.
by maqp 7y ago
Apple can already silently eavesdrop on all iMessages, because they control the public keys inserted to your device. There are no fingerprints to verify you're not under MITM attack so they can just start attacking everyone. Read my lo
600.
by maqp 7y ago
This is an incredibly complex problem and it really depends on the details. which keys are used, which are pinned. Which keys the government has, and which certificates it can and will issue itself. Which clients it will backdoor, and where

More ›