analogist

5 ms·

1.
by analogist 6y ago
Ah yes, enforcing the law, which, “in its majestic equality, forbids rich and poor alike to sleep under bridges, to beg in the streets, and to steal their bread.”
2.
by analogist 7y ago
So you think there is no difference in guilt between being a war criminal’s arm dealer and being a war criminal’s grocer?
3.
by analogist 9y ago
> PS: your mention of that Twitter account is creepy. With no context, I agree. But I'm not exactly stalking engineers here - there was literally a direct link to that twitter from the Fastmail updates mailing list that went out, wh
4.
by analogist 9y ago
Hi Bron. I'm a customer of both Fastmail and GSuite, and I have enjoyed your service for a few years now. I still use Fastmail for some things, like sieve, and very much will continue paying just for the ongoing development of open-sta
5.
by analogist 9y ago
> I’m not willing to stick my neck out > empathy gap Maybe if you were more open to helping them with threats to their livelihood, dignity, and well-being, they’d be more open to helping you with yours? I don’t know, just a thought.
6.
by analogist 9y ago
@bascule addresses deterministic password managers as a category here: https://tonyarcieri.com/4-fatal-flaws-in-deterministic-passw... Certainly you’ve considered these points, and I’m interested in hearing your responses t
7.
by analogist 9y ago
This is so obvious that the first thing I would do is look to see if they've addressed it in some way, instead of assuming incompetence. If you have gone through the process of being charitable-first, instead of dismissive-first, then
8.
by analogist 9y ago
Because they don't transmit your encryption password. Authentication is not done by sending them your encryption password, but instead the derivation of an SRP static secret ( https://en.wikipedia.org/wiki/Secure_Re
9.
by analogist 9y ago
That's pretty much correct, yeah. Due to exponentiation, length is almost everything in password security. Which means there's going to be a bunch of lengths at which brute force cracking is trivial, and then a very sharp rise in
10.
by analogist 9y ago
Wow. This is yet another example of the fatal combination of Rolling Your Own Crypto + Using OpenSSL Directly And Blowing Your Own Foot Off Because It Lets You. var cipher = crypto.createCipher('aes-256-ctr', key.toString(&#x2
11.
by analogist 9y ago
Even conventional VPN is not enough. The Great Firewall of China ( https://en.wikipedia.org/wiki/Great_Firewall ) is a mix of DNS poisoning, deep packet inspection, and traffic and usage analysis based on real time ML. I
12.
by analogist 9y ago
Summary link by OSTIF, which includes a quick synopsis of both audits, and link to full report on OpenVPN 2.4 by OSTIF: https://ostif.org/the-openvpn-2-4-0-audit-by-ostif-and-quark... Matthew Green/Cryptography Enginee
13.
Two OpenVPN Audits by OSTIF+QuarksLab and Matt Green Completed(ostif.org)
3 points by analogist 9y ago|1 comments
14.
by analogist 9y ago
So you would be fine with your local restaurant "denying service" and locking the doors only when the food safety inspectors show up?
15.
by analogist 9y ago
That seems to be pretty weak evidence of verification not being through TLS. There could easily be an additional connectivity check that is http-based (that was blocked by the captive portal) before proceeding onto a standard TLS handshake.
16.
by analogist 9y ago
I think a recurrent concern is OpenVPN's reliance on TLS, and its codebase complexity as a result of being built on OpenSSL--but with far less attention and resources and vuln hunting compared to say, actual browsers. Complexity + lack
17.
by analogist 10y ago
I'm no expert, but intuitively it would seem that encryption-inside-encryption would be snake oil when they're meant to guard against the same layer/attack vector/threat model: for example, if you nest Serpent inside A
18.
by analogist 10y ago
Inside of TLS, 1Password uses an additional SRP handshake that negotiates a static secret (like a DHE), which 1Password uses to both authenticate the user and set up an additional AES-GCM transport encryption. So even a full memory dump of
19.
by analogist 10y ago
As a neuroengineer working in the field, this is quite accurate. Understanding the compute architecture goes a loooong way - after all, acoustic RSA key extraction ( https://www.tau.ac.il/~tromer/acoustic/ ) is poss
20.
by analogist 10y ago
Isn't that's just a description of all TLS? ECDHE/DHE key exchange is essentially employed on any non-poorly configured modern https site, TLS 1.0-1.3draft.
21.
by analogist 10y ago
What can a technologist do about climate change? (2015) http://worrydream.com/ClimateChange/ TL;DR: better energy production/transportation methods, data-driven tools for finding bottle necks in production systems
22.
by analogist 10y ago
I'm not sure where all the aggression and distrust comes from, but if you had done a a simple search, you would easily see that your points are false. 1) a) Every single line shown are thin lines except for the 6 lowest average-ice yea
23.
by analogist 10y ago
The symmetric algorithm aside, if we just look at the key derivation, the --s2k* parameters go up to 65011712 rounds of SHA512. If you maxed out the --s2k* settings, its difference from the 1.4.12 default of 65536 rounds of SHA1 is not stag
24.
by analogist 10y ago
As of Kernel 4.8, Ted Ts'o has already switched /dev/urandom over to ChaCha20 ( https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.... ), so I would say a good CSPRNG's al