maqp

20 ms·

241.
by maqp 2y ago
Too bad I can't send a secure text from my Telegram desktop client. Lucky for me, there's Signal.
242.
by maqp 2y ago
You seem to be living on this weird balance of having no threat model. This is what your post implies 1. Signal is bad and insecure because registering user account requires giving a phone number. 2. Matrix is better, it fixes this by regis
243.
by maqp 2y ago
>You can have your phone compromised (especially when I know your phone number, Signal I’m looking at you) or be subject to other means of attacks, exposing everything. Knowing someone's phone number doesn't automatically let y
244.
by maqp 2y ago
Some other options https://cwtch.im/ (has better UX and security than Briar) https://onionshare.org/ chat feature Also https://github.com/maqp/tfc by yours truly if you need hardware-e
245.
by maqp 2y ago
Oh, I must have missed this. Please tell me how to enable secret chats for groups. And my desktop chats. Also I'd like to turn on the setting for defaulting to secret chats whenever I open a new one. Oh? I can't. Sounds like it&#x
246.
by maqp 2y ago
>It also used to require sharing phone numbers to add contacts It no longer doesn't. It took them a while because you can't just slap features like that. It's not a string in a database like with Telegram. Telegram has gre
247.
by maqp 2y ago
You could also ask about whether they think it's private. And if they say yes, ask them what it means. Does it mean only sender and intended recipients can read the message, or is it fine if the service has someone check the content. W
248.
by maqp 2y ago
That's the dangerous part. It's a messaging app that took in the function of a social media platform. It did so without robust security features like end-to-end encryption yet it advertised itself as heavily encrypted. Like Green
249.
by maqp 2y ago
>To protect the data that is not covered by end-to-end encryption, Telegram uses a distributed infrastructure. Cloud chat data is stored in multiple data centers around the globe that are controlled by different legal entities spread acr
250.
by maqp 2y ago
Yeah, put a geometrician* to do the job of a cryptographer. This is what you get. * I'm being serious, Nikolai Durov's PhD dissertation title was "New Approach to Arakelov Geometry" https://bonndoc.ulb.uni-bon
251.
by maqp 2y ago
No serious project wants to collaborate with a bunch of hobbyist projects who may or may not keep their code up-to-date. Years ago, the Matrix ecosystem was a prime example of even basic features like end-to-end encryption being in many cas
252.
by maqp 2y ago
The entire platform is a joke. It pretends to have no identifiers and heavily markets queues (a programming technique) as a solution to privacy problem. You ask the authors how they solved the problem of server needing to know to which clie
253.
by maqp 2y ago
This kills the forward secrecy. IIRC Signal just has each group member send each group message to each recipient with the standard pair-wise encryption keys. It's the message's headers that lets the recipient know it's intend
254.
by maqp 2y ago
You're assuming end-to-end encryption doesn't exist, and that the only way to be safe is to have someone close to you self-hosting. Self-hosting is terrible in that it gives Mike, the unbeknownst creepy tech guy in the group 100%
255.
by maqp 2y ago
It's a bit unfortunate there isn't a mechanism to establish a key between your desktop and smart phone client that would allow message history to be synced over an E2EE connection. It's doable, but perhaps it's an intent
256.
by maqp 2y ago
>it's just claiming that you can trust them more than you can trust the major messaging apps. All the cool kids in the block eliminated the need to trust the provider decades ago. PGP: 33 years ago, OTR 20 years ago, Signal 14 years
257.
by maqp 2y ago
This is such a misrepresentation. Telegram could at-will feed the cloud-2FA password to password hashing function like Argon2 to derive a client-side encryption key. Everything could be backed up to the cloud in encrypted state only you can
258.
by maqp 2y ago
I don't see it as an issue if the marketing term maintains the original context: "how large a planar FET should be for the transistor density used in this process" Is this the case, I'm not entirely sure. If it is, there
259.
by maqp 3y ago
Wonderful, thank you so much! Good to see Apple fix their app finally.
260.
by maqp 3y ago
Same thing with Signal and most other messengers. Can you link to some documentation that shows iMessage even has the identity numbers?
261.
by maqp 3y ago
Just gonna add here. Do not switch from iMessage to SMS no matter what. Only switch to something like Signal if you need the cross-platform support etc.
262.
by maqp 3y ago
Yeah that's what the fingerprint is for, you compare it to authenticate the key exchange.
263.
by maqp 3y ago
I'm a bit puzzled. Suppose you do single Kyber key exchange, and you then hash the shared secret with a domain separator to get a fingerprint, wouldn't that mean you now have a shared secret that you can verify wasn't under M
264.
by maqp 3y ago
Did anyone figure out how MITM attacks are handled? How does the key transparency work and does it replace public key fingerprints?
265.
by maqp 3y ago
For message security, absolutely. For endpoint security (iMessage as exploit surface), not so much.
266.
by maqp 3y ago
Could you please elaborate, I didn't quite catch what you meant.
267.
by maqp 3y ago
If third party client has optional E2EE, it's not exactly a merit to Apple, aside perhaps them not explicitly blocking such development. I commented on the key verification in the other reply, it appears to be opt-in feature, so warnin
268.
by maqp 3y ago
Whoa, nice to see there's some progression finally! It's weird the blog appears to discuss key insertion, but not MITM attacks. Is there an official source that explicitly states it protects from those too? Also if it's for M
269.
by maqp 3y ago
Gonna repeat myself since iMessage hasn't improved one bit after four years. I also added some edits since attacks and Signal have improved. iMessage has several problems: 1. iMessage uses RSA instead of Diffie-Hellman. This means ther
270.
by maqp 3y ago
>Convincing Intel or AMD to have a hidden back door, and to somehow keep that it hidden, is a nearly impossible task Interesting, how would an X86 instruction with hardcoded 256-bit key would be detected? IIRC it's really hard to au

More ›