maqp

57 ms·

661.
by maqp 7y ago
GDPR blocked in the EU. Any mirror?
662.
by maqp 7y ago
Which is why you'll want to use some open source onion-routed app like Briar, Ricochet, Cwtch, TFC, or Session.
663.
by maqp 7y ago
No the actual message is "Using TrueCrypt" -> UTC -> Coordinated Universal Time. The real culprit are the time thieves as explained in the book "Momo and the Time Thieves". Your mind will see what it wants.
664.
by maqp 7y ago
I apologize for the delay, I don't come here all the time. "E2EE's security is based on the use encryption and secret keys, which must remain secret -- there are a variety of ways that secret keys could potentially be comprom
665.
by maqp 7y ago
Double ratchet was built on top of 2004 OTR's Diffie-Hellman ratchet. From what I understood the difference was using different, post-quantum, algorithms for this patent. The thing is, post-quantum algorithms haven't even been sta
666.
by maqp 7y ago
Matthew outlined much of the Matrix problems but not in the context of the latter part of his idealistic thoughts. Just going to point out that if agreeing on spec is six time slower, that's just the first car of traffic jam slowing do
667.
by maqp 7y ago
"Either way, the paper's story is "correct" -- but it causes a crapload of harm to the application developer, who only wanted to make a dollar by providing an equal-and-opposite value, and never intended for these things
668.
by maqp 7y ago
US has basically modernized slavery with the for-profit prison system: https://www.youtube.com/watch?v=sHz2Hmq7soo
669.
by maqp 7y ago
Or you can just straight up arrest a citizen and ask why they spoke ill about the police on WeChat: https://twitter.com/Snowden/status/1208469511051075585
670.
by maqp 7y ago
Security is about verifiability. If you can't verify it's secure, it's not trustworthy. I've been looking into secure communication stuff for almost ten years now, and there's a low bar that makes it easy to inspect
671.
by maqp 7y ago
You're right. I apologize. I'm just absolutely terrified about the inevitable hack -- when intelligence establishment gets their hands on everyone's private messages on Telegram servers, or when some hacker leaks them.
672.
by maqp 7y ago
I'm glad there isn't another UAE based app that stores billions of messages on its servers, effectively in plaintext, including all group chats, all desktop client chats, and overwhelming majority of one-on-one chats that aren&#x2
673.
by maqp 7y ago
I couldn't agree more. It's a rare sight to see a secure communication tool be completely open about the complex threat model of modern world. When I started working on TFC (a messaging system that utilizes high assurance architec
674.
by maqp 7y ago
Moxie has good points about the problems TLS has. And they are not about breaking TLS via cryptanalysis: https://www.youtube.com/watch?v=UawS3_iuHoA
675.
by maqp 7y ago
Matrix is not usable as it is: 1. Bikeshedding has lead to reduction in security agility: Any change will have to be first implemented for the protocol, then to SDKs, then to clients. This progress can take years. 2. Riot is the only client
676.
by maqp 7y ago
Signal also features multi-device end-to-end encryption. This non-technical argument feels more and more a shill talking point because the claimed constraint is NEVER provided with technical arguments. However, it feels intuitive to non-tec
677.
by maqp 7y ago
SSL was THE thing in 1995. End-to-end encrypted email has existed since 1991 (PGP), and for instant messaging you've been able to use OTR since 2004. End-to-end encryption is what is needed, SSL is the bare minimum for everything. It&#
678.
by maqp 7y ago
The problems is, companies like VeriSign offer LEA services Quoting https://papers.ssrn.com/sol3/papers.cfm?abstract_id=1591033 “Verisign also operates a ‘Lawful Intercept’ service called NetDiscovery. This service is
679.
by maqp 7y ago
Kudos for your work!
680.
by maqp 7y ago
Dealing with the endpoint security is a really tough problem but I have a pet-project that pushes the price per endpoint just below $500 https://github.com/maqp/tfc
681.
by maqp 7y ago
"They don’t claim end to end encryption by default though." They don't have to. The amount of my peers (i.e. who also major in CS) who think Telegram is more secure than e.g. WhatsApp, is staggering. People don't really
682.
by maqp 7y ago
iMessage has several problems: 1. iMessage uses RSA instead of Diffie-Hellman. This means there is no forward secrecy. If the endpoint is compromised at any point, it allows the adversary who has a) been collecting messages in transit from
683.
by maqp 8y ago
Nice to see you again Nick P! Yes the use of Tor Onion Services is a brand new thing and something I've been working since the fall of 2017. Piggy-backing on Pidgin was always a temporary solution: The Snowden documents and Hayden&#x27
684.
by maqp 8y ago
(It's actually only sending computer that must not be compromised during installation, but in other respects you're right.) The other nice aspect is Onion routing by default similar to Briar, Ricochet, Onionshare and Cwtch. TFC ha
685.
by maqp 8y ago
It's not just individual targets. The big concern is economics of automating remote exploitation, as explained by ACLU's Christopher Soghoian here: https://media.ccc.de/v/33c3-8136-stopping_law_enforcement_ha.
686.
by maqp 8y ago
I can't wait for this to become a thing! I've loved Ricochet since day one. OnionShare has been another great system https://onionshare.org/ and I'm extremely happy I've been able to help them, if only a
687.
by maqp 8y ago
Author here. Since both are located in the capitol area of Finland and names are too close to another not to cause a mix up, I think it's important to clear any confusion: The FoilChat company was founded on November 2013, and their fi
688.
Show HN: TFC – Onion-routed, endpoint secure messaging system(github.com)
2 points by maqp 8y ago|0 comments
689.
by maqp 11y ago
Closed source hardware is indeed a problem: If the HW of TxM is pre-compromised, the device/malware running on it might spit out what it thinks is the key via serial or alternative covert channel. If you start developing on top of TFC,