maqp

57 ms·

631.
by maqp 7y ago
"Facebook doesn't control it." Unfortunately it's controlled by the Mark Zuckerberg of Russia who still has access to his data brokers. None of the companies with access to our private data seem problematic at first. Goo
632.
by maqp 7y ago
Thank goodness there's the highly optimized Telegram Desktop client that's not a tire fire since it has the secure end-to-end encryption for both group chats and one-on-....ahahahahahahahahahaha
633.
by maqp 7y ago
Now that's a horrible UX See how many of your friends use Briar. You need an existing social graph to start. Also, secure cloud backups for the account data isn't an easy thing, see e.g. their blog post on that. But now that it&#x
634.
by maqp 7y ago
I agree so much. There's a long list of reasons cryptographers like Schneier and Green recommend Signal, and why they advice against using Telegram. I've never seen any cryptographer or security expert recommend Telegram. It'
635.
by maqp 7y ago
Same problem with Telegram. You can't register account without phone number. Also, Signal is already working on user names, it's just a lot more complex problem than you might think.
636.
by maqp 7y ago
"Compared to Telegram (which is also privacy-focused and NOT owned by Facebook like WhatsApp is) that simply works, I'm not sure what Signal brings to the mainstream table." Firstly, with Telegram asynchronous chats are trivi
637.
by maqp 7y ago
"Many cryptographers don't believe SGX will be technologically reliable anytime soon" E.g. for online backups, SGX will only handle rate limiting. If you're using sufficiently secure password (+80 bits), Argon2 will prov
638.
by maqp 7y ago
Good thing Snowden thinks twice before recommending anything.
639.
by maqp 7y ago
So what percentage of Matrix users will now be using E2EE chats? Is it both groups and one-on-one chats or will there exist disparity between the two? Does the app prompt enabling E2EE in rooms where it's not enabled?
640.
by maqp 7y ago
iMessage is riddled with security issues: https://news.ycombinator.com/item?id=21425897 Also, Telegram still * Has no E2EE by default * Has no E2EE for desktop clients * Has no E2EE for groups. When security is an afterthou
641.
by maqp 7y ago
The point of encryption is to protect content from third parties. TLS-like encryption where messages can be read by server, is not protecting the content this way, therefore, calling it encryption is misleading. When average user asks &quot
642.
by maqp 7y ago
The news is this: "CIA owned CryptoAG in collaboration with the intelligence establishment of West-Germany"
643.
by maqp 7y ago
Not going to happen, considering djb vs US declared code free-speech; E2EE is implemented in code so you can't ban it without violating the constitution.
644.
by maqp 7y ago
It is when everyone uses Tor. Nobody uses Tor: Everyone is surveilled. Few activists use Tor: Activists are easy to pick and everyone else is easy to surveill. Everyone uses Tor: Nobody can be surveilled. Nothing to gain by not using Tor, o
645.
by maqp 7y ago
Rolling one's own crypto has become a catch-all phrase. It's of course very important to remember implementing standard algorithms in non-standard way can be incredibly dangerous too. I've seen unauthenticated AES-CBC way too
646.
by maqp 7y ago
"by far the largest weak point" Well, if the nested ciphers are all properly implemented AEAD schemes, use unique keys, and don't rely on public key crypto for key exchange, cascading crypto is fine. Other than that their dis
647.
by maqp 7y ago
having millions of encryption algorithms out there would be inherently more secure than a lot of people standardized on one Enclosing letters in paper the thickness of which has a million variations doesn't mean one of them is magicall
648.
by maqp 7y ago
Lavabit also sent the private keys from their servers to clients using TLS that utilized RSA for key exchange. Levison was to put it into a word, a fool, for letting that happen. Once he had to submit the private RSA-key for the certificate
649.
by maqp 7y ago
There's nothing that shows TrueCrypt is backdoored. Read the audit by nccgroup: https://opencryptoaudit.org/reports/TrueCrypt_Phase_II_NCC_O... There were vulnerabilities in the software, but nothing that allows t
650.
by maqp 7y ago
Plus there's the good old endpoint hacking for key exfiltration Snowden said the NSA was doing every single day.
651.
by maqp 7y ago
Most keys are at least 2048 bits nowadays. Bullrun's not about breaking modern key sizes that much is sure.
652.
by maqp 7y ago
Well not exactly. Snowden was extremely vocal about NSA going around encryption and stealing keys from the endpoints. I've collected those statements here: https://www.youtube.com/watch?v=3euYBPlX9LM PGP uses RSA which
653.
by maqp 7y ago
Mad guy speeds across London streets with a highly customized vehicle. Also, tanks. I see no difference.
654.
by maqp 7y ago
https://en.wikipedia.org/wiki/Gary_Webb#Death
655.
by maqp 7y ago
Most of it is economic and political espionage, not spying on each others' military secrets. That happens too, sure, but none of the other stuff is necessary to protect us from nuclear war.
656.
by maqp 7y ago
iMessage is so riddled with problems from using weak RSA key sizes (1280 bits), to using RSA in the first place (thus no forward secrecy), to apple essentially managing the public keys for the user (which allows transparent MITM due to lack
657.
by maqp 7y ago
many thanks!
658.
by maqp 7y ago
The number of companies I've never heard of there is quite amazing. I'd really like to know how many of these are about data science/analytics.
659.
by maqp 7y ago
There's nothing that prevents the US government from hacking Chinese TelCo equipment. Thus I think it's more likely it's about traditional competition. Of course it's cheaper to put a "NOBUS" backdoor than to h
660.
by maqp 7y ago
"Typical American companies aren't controlled by the CIA or other government agencies." True but that doesn't mean there aren't national interests in play when it comes to information security companies deploying cr

More ›