maqp

15 ms·

181.
by maqp 2y ago
Or the companies have figured out it's more expensive to hire a full time professional cryptographer to vet the process, than to deal with the PR for now more or less normalized data breaches.
182.
by maqp 2y ago
>Developers can’t be expected to blindly believe every reply with a snarky tone and a blog link? Developers are adults with responsibility to know the basics of what they're getting into, and you don't have to get too far into
183.
by maqp 2y ago
>It doesn't address any points Taking some time to point out the vulnerability is already charity work. Assuming that's also a commitment to a free lecture on how the attacks work, and another hour of free consultation to look
184.
by maqp 2y ago
NO ONE should trust a website delivering JS that could do who-knows what the next time they skip reading the code. Like, send the inputs to a third party. Please delete this project and your comment. If you want to be helpful, write native
185.
by maqp 2y ago
So, you have nothing. Best of luck.
186.
by maqp 2y ago
Good list, I'd add "eat lightly before heading to the store", you don't want to be hungry when you pass the Snickers aisle.
187.
by maqp 2y ago
A good salad worked wonders for me. Current favorite is -2 iceberg lettuces -1 cucumber -1 red bell pepper -2 red onions -some frozen spinach and peas (melted in microwave) -1 steamed broccoli -8 hard-boiled eggs -3 packets of strong feta c
188.
by maqp 2y ago
>We don't think Tor should be default, because Tor has bad threat model for many people, and bad usability for most people. Here's the thing. If you're going to say your system doesn't have identifiers, you better mak
189.
by maqp 2y ago
What? You have factual evidence Signal's apt repo is installing rootkits to people's computers? Let's see it.
190.
by maqp 2y ago
Like someone once said, "Pidgin is a flock of zero-days flying in formation". It had serious issues with leaking messages to other applications via dbus, I know this because I used that feature to stab in the earliest version of m
191.
by maqp 2y ago
Telegram has secret chats, but only for mobile 1:1 chats. You want secret chat for groups? Sorry, can't do. (Signal can.) You want secret chats for desktop messages? Sorry, can't do. (Signal can.) You want everything end-to-end en
192.
by maqp 2y ago
If that's the case, sounds like he should have never collected the data in the first place :) Data is a toxic asset, as Schneier explained in 2016 https://www.schneier.com/blog/archives/2016/03/data_
193.
by maqp 2y ago
No. The way I see it, I'm downloading an open-source, *always* end-to-end encrypted desktop-application Signal from official repository, instead of downloading an open-source *never* end-to-end encrypted desktop-application Telegram fr
194.
by maqp 2y ago
Why would they?
195.
by maqp 2y ago
As per https://github.com/simplex-chat/simplexmq/blob/stable/protoc... """ SMP is initialized with an in-person or out-of-band introduction message, where Alice provides Bob with details o
196.
by maqp 2y ago
>you simply don't like the fact that we don't recognise user IP address as a permanent user identifier on the protocol level So how exactly are all those DMCA letters finding themselves to the correct household if IP address do
197.
by maqp 2y ago
Beta version: # 1. Install our official public software signing key wget -O- https://updates.signal.org/desktop/apt/keys.asc | gpg --dearmor > signal-desktop-keyring.gpg cat signal-desktop-keyring.gpg | sudo te
198.
by maqp 2y ago
Oh interesting, thanks for letting me know!
199.
by maqp 2y ago
Yeah that hourly packet rate is called traffic masking or traffic flow confidentiality. It's offered in some instances of IPSec, but given that it's not exactly a common protocol in end-user products you don't really see it.
200.
by maqp 2y ago
Thanks for owning up :)
201.
by maqp 2y ago
Lol that article says >We believe that Tor may be the wrong solution for some users for one of the reasons: much higher latency, error rate and resource usage. Yet you provide no options for Tor, as in https://simplex.chat&#x2
202.
by maqp 2y ago
There's a LOT of SimpleX shilling lately on HN. tldr, it's snake oil. The company lies about its system being able act as a server without knowing anything about the users. The SimpleX clients don't route via Tor so the serve
203.
by maqp 2y ago
Most likely not, because Telegram wouldn't be a massive hosting platform for CSAM.
204.
by maqp 2y ago
Yes let's infer app security from 5D-chess of spy novel grade news analysis, instead of reading source code. Telegram: client source code shows e.g. all group messages are always shared to the company Signal: client source code shows e
205.
by maqp 2y ago
Yeah absolutely not. The project lies about its ability to look away from the fact it has access to all IPs conversing. A server has to have a way to relay packets from identifier A to identifier B, yet they claim they don't know if A
206.
by maqp 2y ago
Yes, those three words are rally cry to support rich people breaking laws and ethics. A tech billionare hosting child porn for closer to a decade on his app isn't the context you want revolutionary slogans to shield.
207.
by maqp 2y ago
Encryption between you and the service provider isn't encryption protecting you from the service provider. No end-to-end encryption means no encryption for messaging. The only context where client-server encryption matters is when I wa
208.
by maqp 2y ago
Telegram was never properly end-to-end encrypted. The way this works is Telegram client sends stuff to the server over client-server encryption. The service provider stores it on server's disk in Netherlands. Since Netherlands is not U
209.
by maqp 2y ago
Whataboutism.
210.
by maqp 2y ago
There's nothing in Telegram that couldn't be implemented with security in mind. They just lack the expertise in designing cryptographic protocols that offer those features, and Durov is too proud to consult experts in helping impr

More ›