galadran

8 ms·

1.
by galadran 3mo ago
In effect, yes it does. The Recommended flag is set for X25519MLKEM768. It is not set for any of the pure PQ key exchanges. https://www.iana.org/assignments/tls-parameters/tls-paramete...
2.
by galadran 3mo ago
I'm afraid you've misunderstood. These codepoints are for the pure MLKEM key establishment that DJB is railing against. All of these libraries also support the hybrid forms, which have different codepoints and are used by default.
3.
by galadran 3mo ago
This is garbage from start to finish. There are already codepoints assigned for MLKEM 512/768/1024 (0x0200, 0x0201, 0x0202) and nearly every major library supports it already: - OpenSSL (ML-KEM-512/768/1024) - Bori
4.
by galadran 3mo ago
> If nothing changes, users will increasingly be forced to choose between their privacy and their access to the web Shorter post: https://blog.mozilla.org/en/privacy-security/keeping-the-web...
5.
by galadran 3mo ago
More details: https://blog.mozilla.org/en/privacy-security/keeping-the-web...
6.
Keeping the Web Open and Private in the Bot Era(blog.mozilla.org)
6 points by galadran 3mo ago|0 comments
7.
by galadran 3y ago
EU Commission FAQ (emphasis mine): Recognition means that web browsers are required to ensure support and interoperability for the QWAC for the sole purpose of displaying identity data in a user-friendly manner. *Recognition of QWACs implie
8.
by galadran 3y ago
As I commented there, you've misunderstood this change. There's a difference between certificates distributed with the OS and certificates added to the OS by a user. Right now Firefox ignores both. This change ONLY picks up the ce
9.
by galadran 3y ago
There's a difference between certificates distributed with the OS and certificates added to the OS by a user. Right now Firefox ignores both. This change ONLY picks up the certificates added to the OS by a user.
10.
by galadran 3y ago
"Agreed behind closed doors" would probably be better than "Secret Law" but I guess its a question of brevity.
11.
by galadran 3y ago
https://en.wikipedia.org/wiki/Formal_trilogue_meeting
12.
by galadran 3y ago
https://eidas-open-letter.org The open letter signed by 300+ researchers, professors and experts.
13.
by galadran 3y ago
Title should probably be: "Last Chance to fix eIDAS: Secret EU law threatens Internet security"
14.
by galadran 3y ago
https://last-chance-for-eidas.org/
15.
by galadran 3y ago
This isn't the right summary. Firefox uses it own root store still and ignores any certificates distributed by default in the OS. However, if the user installs their root to the OS, Firefox will also pick it up. This is how other brows
16.
by galadran 3y ago
Mozilla's launch earlier this week: https://blog.mozilla.org/en/products/firefox/encrypted-hello...
17.
by galadran 3y ago
I believe CF and others buckled under pressure from major websites which didn't want to be used as fronts for other website's traffic. ECH fixes this because individual sites get to opt-in to using it.
18.
by galadran 3y ago
Any provider can deploy ECH, it's standardized at the IETF. Cloudflare are just first.
19.
by galadran 3y ago
The point is that network operators can't tell which website the user is visiting, as it could be any of the sites hosted by the ECH provider. In this case, Cloudflare are acting as the ECH provider and as they already host the website
20.
by galadran 5y ago
The disclosure and test cases: https://www.openwall.com/lists/oss-security/2021/12/01/4
21.
by galadran 5y ago
More details: https://www.openwall.com/lists/oss-security/2021/12/01/4
22.
by galadran 5y ago
> It is not fun but frustrating to work in Rust. Deeply subjective. Rust has been the most loved language on Stack Overflow for 5 years in a row now. > add a new huge dependency Sure, but setting up Rust is much much easier than GCC w
23.
by galadran 5y ago
1. Of the literally hundreds of maps on his site, there are only two which are actually based on Middle Earth. 2. 'Style' is not copyrightable. No one owes royalties to Picasso for Cubism. 3. Plagiarism is representing someone els
24.
by galadran 6y ago
The associated paper [1] summarises the information revealed by Signal succinctly: The Signal messenger is primarily focused on user privacy, and thus exposes almost no information about users through the contact discovery service. The onl
25.
by galadran 6y ago
Some high level observations on their design: They use Bluetooth identifiers that last for 24 hours, which breaks Wifi/Bluetooth MAC rotation and allows 3rd parties to track users. They require a connection to be established between ea
26.
by galadran 6y ago
GCHQ's technical design document is here: https://www.ncsc.gov.uk/report/nhs-covid-19-app-privacy-secu... Some observations on their design: They refresh the identifiers broadcast by each device every 24 hours. So
27.
Decentralized Privacy-Preserving Proximity Tracing [pdf](github.com)
4 points by galadran 6y ago|0 comments
28.
by galadran 7y ago
Hi, The attack described in the blog post dates from 2015. The ACME challenge protocol has been updated a few times since then. You are completely correct that signatures aren't really needed for the challenges, yet this was the initia
29.
Draft “Secure Communication Principles” from GCHQ Don't Mention E2E Encryption(twitter.com)
3 points by galadran 7y ago|0 comments
30.
by galadran 7y ago
https://eprint.iacr.org/2019/779 - Paper on the fun things you can do with signatures, including a write up of the Let's Encrypt Attack discovered in 2015 and some more recent attacks.

More ›