moxie

38 ms·

301.
by moxie 14y ago
Or for that matter, just remove the internal MMC and stick it in a reader (most Android devices don't use MTD anymore). This was what was so shocking about the case with the FBI and the pimp, since that device wasn't even encrypted: http:/
302.
by moxie 14y ago
Totally, but remember that this is about recovering FDE keys. I'm sure that there are plenty of people who leave their bootloaders unlocked, but they're probably also not encrypting their device, so they're out of luck in the case of a phys
303.
by moxie 14y ago
The research that's new here is that they've written and released a recovery image which actually does the work of a "cold boot" attack. However, from their site: "To break disk encryption, the bootloader must be unlocked before the attack
304.
by moxie 14y ago
You don't have to defend yourself to me. I'm not saying you (or "hackers") are wrong or something, just that these are not necessarily shared beliefs among anarchists. What you're describing is more akin to (classical) liberalism. For ins
305.
by moxie 14y ago
Perhaps my perspective is tainted by living in the bay area through two (three?) tech bubbles, however I still don't see it. I agree that HN-type hackers and anarchists both use aesthetically similar language, like "changing the world," bu
306.
by moxie 14y ago
There's an old wobbly story: A wobbly was riding a freight train across the midwest one summer, in between jobs. The train sided out in the middle of nowhere, and it was scorching hot, so the wobbly got off the train and started walking d
307.
by moxie 14y ago
I'm curious to know why you see them as a guest in your home, rather than the other way around?
308.
by moxie 14y ago
Radical punk rock literally saved my life. As someone who's been a part of both of these worlds off and on for 16 years, I couldn't disagree with you more. I see the aesthetics of the hacker and punk scenes as being extremely similar, wh
309.
by moxie 14y ago
This article should really be titled "The Street Kids Of Hippy Hill." By going to one place in order to get a feeling for "street kids," they've gotten an extremely myopic view of that scene. The full picture is much more varied. Traveler
310.
by moxie 14y ago
I work on RedPhone and TextSecure, two GPLv3 apps for mobile encrypted voice and SMS: http://www.whispersystems.org
311.
by moxie 14y ago
Interesting. And beyond network position, do you think it's possible to measure these micro timing differences effectively against a server that experiences the type of load patterns Google's servers do? (And yeah, I have little faith in D
312.
by moxie 14y ago
Most organizations were already prioritizing RC4 before that, simply because it's fast (23 in order instructions per byte!).
313.
by moxie 14y ago
@agl, it looks to me as if the timing differences they are measuring would be a complete wash in any realistic scenario? The original "good enough" timing fix (in response to Vaudenay) was based on the assumption that an attacker would not
314.
by moxie 14y ago
This is an entirely theoretical attack, and is an extension of a known (practical) attack that was published by Vaudenay back in 2002. Vaudenay pointed out that using CBC-mode in the "authenticate-then-encrypt" paradigm was dangerous, becau
315.
by moxie 14y ago
Fair enough, I should have been more specific. I was trying to imply that this is not a for-profit project, but you're correct, that's not what a software license communicates.
316.
by moxie 14y ago
We use RTP (actually SRTP and ZRTP), but the transport is still UDP.
317.
by moxie 14y ago
They're grant funded, as is some ongoing development work.
318.
by moxie 14y ago
Your NAT traversal strategy is limited by the type of NAT being employed. Traditionally, the worst case scenario for NAT traversal is "symmetric NAT." Symmetric NAT means that each tuple of (source_ip, source_port, destination_ip, _destina
319.
by moxie 14y ago
Agreed. We haven't run into this yet (and aren't charging at all, this is an OSS project), but I think that would be the point where you have to do one of two things: 1) Architect your DNS response to include a small sample of the total re
320.
Creating a low-latency high-availability network for voice calls(whispersystems.org)
50 points by moxie 14y ago|15 comments
321.
by moxie 14y ago
Chrome's pinning logic is disabled for connections where the signing cert was added to the trust store by a user, I think largely in part to avoid breaking these type of corporate MITM proxies. So if you want to watch the traffic, it should
322.
by moxie 14y ago
It's not really that difficult. Let's say you've got a column called 'insecure_pass' that is storing a simple md5 hash of users' passwords. Four simple steps: 1) You add a new password column to your DB (secure_pass) and modify your accou
323.
by moxie 14y ago
I've always assumed this is exactly why silicon valley companies have unlimited vacation policies. They know their employees won't take much vacation time, and this way they won't have to put the balance on the books.
324.
by moxie 14y ago
Agreed there's nothing in the data to directly suggest government involvement. It's only "sloppy," though, when conceptualized as a MITM. China does have an extensive history of censoring access to sites, and recently censored access to Git
325.
by moxie 14y ago
I don't think either would help in this situation. HSTS helps prevent SSL stripping attacks, which whoever is denying SSL access to GitHub doesn't need to bother with. 2FA serves as an annoyance to phishers, but whoever is doing this netwo
326.
by moxie 14y ago
To clarify, this looks more like someone turning off SSL access to GitHub than a proper MITM attack in the traditional sense. The certificate in that link is just a self-signed certificate, not something signed by a CA: Issuer: C=US, ST=Som
327.
by moxie 14y ago
The potential problem is that you've just described a malware author's dream. I know it's probably an unpopular opinion, but I don't believe that we should be distributing APKs outside of the Play channels. It takes us back to the PC distr
328.
by moxie 14y ago
This looks like a great project. My only feedback is that in these types of situations, the tendency is for people to use the tools they already have. For the London riots that was BBM, for Tunisia and Egypt that was Facebook and Twitter.
329.
by moxie 14y ago
My recommendations would be: 1) Prioritize ECDHE-RSA-RC4-SHA. This gives you forward secrecy, is reasonably fast, and avoids the security problems with how block ciphers are integrated into TLS (see http://www.imperialviolet.org/2011/11/2
330.
by moxie 14y ago
But the entire point of client-side encryption is to avoid having to trust a server. If you have to trust the server, then there's no reason to do the client-side encryption at all. It's just overhead at that point.

More ›