tazjin

77 ms·

901.
by tazjin 11y ago
It's interesting that the word "photoshopped" is being used for this kind of manipulation as well.
902.
by tazjin 11y ago
But the time we're talking about to understand this is less than 5 minutes. Those same people spend more time joking about how complex the options are and linking that xkcd anyways.
903.
by tazjin 11y ago
I honestly don't understand the meme of "tar is so hard to use". You only need to know like five parameters (xcvfz) for 99% of use cases, and they're pretty easy to understand.
904.
by tazjin 11y ago
For many people, everything that doesn't have a flashy Javascript-frontend does not count as a service.
905.
by tazjin 11y ago
Not sure what the penalties for disclosing an NSL are, but companies sometimes use warrant canaries[1] for this purpose. Notably the one used by Apple disappeared some time last year. [1]: https://en.wikipedia.org/wiki/
906.
by tazjin 11y ago
Yes, it's supposed to be a hash of the user's identifier. The goal is of course being able to look up the keys of individual users based on their publicly shared identifier. This system isn't trying to hide a user's keys
907.
by tazjin 11y ago
> it also removes an element of privacy What are you thinking of specifically? The chain wouldn't contain any network of contacts (like GPG signatures) and only hashed information about the user. Worst case is that a user's num
908.
by tazjin 11y ago
Hey, I'm afraid I don't understand your comment. Can you explain?
909.
by tazjin 11y ago
That's always an option, but it will never let you revoke a device again such that future messages won't be encrypted for it.
910.
by tazjin 11y ago
It depends on what you are establishing trust to, Bob's account, Bob's first key or Bob as a person? The service could write a hash of Bob's account name / phone number / whatever and the account's identity to
911.
by tazjin 11y ago
> Rolling their own cryptography and selling it on the app store would probably be worse, as a first public engagement Also not something I would do because I don't feel qualified to implement this beyond a simple POC :-)
912.
by tazjin 11y ago
Thanks for taking the time to give some feedback, appreciated! I didn't say Signal isn't usable, but it doesn't fit into the requirements because there should not be a distinction between primary/secondary devices after
913.
by tazjin 11y ago
The point is to not have a primary device, every device added to the pool should be able to sign in new devices.
914.
The Security, Usability and Multi-Device-Problem of Messaging Apps(tazj.in)
57 points by tazjin 11y ago|31 comments
915.
by tazjin 11y ago
That's slightly better but still cumbersome to set up and with the primary device as a SPOF. What does the recovery procedure look like if you lose the master?
916.
by tazjin 11y ago
Of course they know what that is - and actively use it - just think of Facebook messenger.
917.
by tazjin 11y ago
That's quite literally multi-device >>sync<<, as in there is only one receiver and the rest is dependent on that. Seems like a low effort solution and would not satisfy my requirements, but it probably works for some people
918.
by tazjin 11y ago
What a strange remark. Are you envious of those who have someone to talk to?
919.
by tazjin 11y ago
No, iMessage for example generates a unique key pair per device and submits your public key to the key pool for your account. Devices can then sync old history using each other's keys and new messages will be encrypted for all devices.
920.
by tazjin 11y ago
Yes, but the amount of people who actually use secret chats is tiny. It reminds me a bit of the CAP-theorem: Security, Device Sync and Usability. Pick two. My personal preference is solving DU, because I can do security aware stuff with GPG
921.
by tazjin 11y ago
Signal, and in extension the other privacy-aware messengers (Threema etc), can not replace Telegram or iMessage because they lack basic features like multi-device sync. The hard problem of messaging has not been solved yet, what people shou
922.
by tazjin 11y ago
Same goes for Google's own Compute Engine, which doesn't support IPv6 at all. Curiously Google's managed MySQL instances receive IPv6 addresses by default, but I believe that's the only component of their service that do
923.
The end of dynamic languages?(tazj.in)
3 points by tazjin 11y ago|1 comments
924.
by tazjin 11y ago
"mach" is imperative singular, "macht" is imperative plural. So "mach bitte das Licht aus" is addressing Honecker directly (which is most likely intended here), where "macht bitte das Licht aus" would
925.
by tazjin 11y ago
> This is not going to be a fun week for Chrome users Disagreed! This is a great week to see which sites break because of this in order to avoid them in the future. (Yes, leading a life without Flash, PHP, Node and all the other horrible
926.
by tazjin 11y ago
You can legally import alcohol into Sweden, you can't legally sell it.
927.
by tazjin 12y ago
If they had USB installers instead of CDs I'd buy them and actually use them as well.
928.
by tazjin 12y ago
That seems to be local time in Hong Kong. Edit: Just noticed that it says all times are US Pacific. Hm, then it is in the future.
929.
by tazjin 12y ago
Where I live (Stockholm) Google Maps has become completely useless at finding anything. It used to be the case that you could search for the name of a store chain (e.g. Systembolaget - the state alcohol stores) and it would show some of the
930.
by tazjin 12y ago
My ISP at home (Bahnhof) actually offers IPv6, I haven't asked them to activate it yet though.

More ›