upofadown

9 ms·

121.
by upofadown 10mo ago
The mechanical analogy is particularly interesting here because at least one of the claimed vulnerabilities involves tricking the victim into decrypting an encrypted message for the attacker and then sending it to them. If someone can be tr
122.
by upofadown 10mo ago
>The fact that it’s short enough that I even need to think about whether it’s a problem is, frankly, pathetic. Please resist the temptation to personally attack others. I think you mean that 64 bits of hash output could be trivially coll
123.
by upofadown 10mo ago
Here is my take on the OpenPGP standards schism: * https://articles.59.ca/doku.php?id=pgpfan:schism Nothing has improved and everything has gotten worse since I wrote that. Both factions are sleepwalking into an interoperab
124.
by upofadown 10mo ago
>And it wants to identify keys by 32-bit truncated hashes. That's 64 bits these days. >I should really not have to even think about the interaction between decryption and verification. Messaging involves two verifications. One to
125.
by upofadown 10mo ago
Do you mean keyservers? Keyservers have nothing to do with the identity verification required to prevent MITM attacks. There is only one method available for PGP. Comparison of key fingerprints/IDs. Keyservers are simply a convenient w
126.
by upofadown 10mo ago
Some of these are suggesting that an attacker might trick the victim into decrypting a message before sending to the attacker. If that is really the best sort of attack you can do against PGP then, yeah, that is the kind of vibe you might g
127.
by upofadown 10mo ago
Are you referring to "Encrypted message malleability checks are incorrectly enforced causing plaintext recovery attacks"? Seems like a legitimate difference of opinion. The researcher wants a message with an invalid format to retu
128.
by upofadown 10mo ago
I think it would be more accurate (and more helpful) to say that the two factions in the OpenPGP standards schism[1] have pulled away from the idea of consensus. There is a fundamental philosophical difference here. The LiberePGP faction (G
129.
by upofadown 10mo ago
There is some misleading stuff in that article. To save time I made an article to provide my commentary: * https://articles.59.ca/doku.php?id=pgpfan:tpp
130.
by upofadown 10mo ago
Commercial aviation involves mostly textual interaction[1] to determine what the aircraft does, for most of the time. Aviation is rife with plain text, usually upper case for better legibility[2]. [1] https://en.wikipedia.org&#x2
131.
by upofadown 10mo ago
My understanding is that there was a language fork after 5.1. One thing was a complete reworking of how math works. It used to be just floating point for everything but the new idea was to make it like Python 3. So most operations are float
132.
by upofadown 10mo ago
Perhaps? The sort of quantum computers that people are talking about now are not general purpose. So you might be able to make a useful quantum computer that is not Shor's algorithm.
133.
by upofadown 10mo ago
The energy used to liquefy the CO2 is the bulk of the energy stored. They don't throw it away afterwards. The the liquid-gas transition is why this works so much better than compressed air.
134.
by upofadown 10mo ago
A single SKS server can not serve a fake key, only a valid key that existed in the past. This might be done to maliciously unrevoke a key. The normal PGP key integrity prevents straight up forgeries.
135.
by upofadown 10mo ago
The good old SKS network achieves most or all of the advantages of key transparency in a simpler way by being append-only. An attacker could downgrade your PGP identity on one server but the rest would have the newest version you uploaded t
136.
by upofadown 10mo ago
Last I heard, PDFs can have javascript in them.
137.
by upofadown 10mo ago
When you cryptographically sign something you need to be sure of what you are signing. That means that you have to be able to look at the document and see each and every character that you are agreeing to. So in a future where we actually w
138.
A Journalist Reported from Palestine. YouTube Deleted His Account(theintercept.com)
3 points by upofadown 10mo ago|0 comments
139.
by upofadown 11mo ago
If you are searching for references with plausible sounding titles then you are doing that because you don't want to have to actually read those references. After all if you read them and discover that one or more don't support yo
140.
by upofadown 11mo ago
No particular name. Just deniability. I personally like to call this particular scheme, deniability through claimed forgery. Not particularly clever. You just provide your correspondent with what they need to forge your messages after the e
141.
by upofadown 11mo ago
This is mostly about the usability issues that make such attacks work so well on Signal: https://www.ndss-symposium.org/wp-content/uploads/2018/03/09... This adds some detail about how Signal can do MITM
142.
by upofadown 11mo ago
SPF, DKIM, DMARC are all about server reputation. They don't count as any sort of update to email and don't affect the protocol. These days regular non E2EE email is as secure as any other messaging protocol that relies on trusted
143.
NSA and IETF, part 3: Dodging the issues at hand(blog.cr.yp.to)
316 points by upofadown 11mo ago|229 comments
144.
by upofadown 11mo ago
This is ultimately a usability issue. The Signal app has a feature called sealed sender. The assumption is that a feature actually does what it is intended to do. Signal makes no effort to inform the user about the limitations of this featu
145.
by upofadown 11mo ago
The paper: Improving Signal's Sealed Sender https://www.ndss-symposium.org/ndss-paper/improving-signals-...
146.
by upofadown 11mo ago
Just some speakers hooked to an amplifier which is plugged into a computer audio output jack.
147.
GNOME 50 completes the migration to Wayland, dropping X11 backend code(linuxiac.com)
107 points by upofadown 11mo ago|185 comments
148.
From Collaborators to Consumers: Have We Killed the Soul of Open Source?(my-notes.dragas.net)
1 points by upofadown 11mo ago|0 comments
149.
by upofadown 11mo ago
At 6am every day I run a script that dumps the scheduled events for the day out of remind. If there are any events the script: * Makes a unique noise on the house announcement system. * Sends me an email with the events. * Sends me a SMS wi
150.
by upofadown 11mo ago
Like with all voice communications, context is important. There are only a limited number of things normally said and most transmissions are about things that were decided before the flight. Everyone involved is used to the bandwidth limite

More ›