handsomeransoms

5 ms·

1.
SecureDrop 0.3, with the results from our third security audit(freedom.press)
8 points by handsomeransoms 11y ago|0 comments
2.
by handsomeransoms 12y ago
Whether or not this is acceptable depends on your threat model. If you believe your adversary might compromise or coerce the service operator, then you cannot trust in-browser encryption even if it is served over https - the code sent to yo
3.
by handsomeransoms 12y ago
This is very similar to the functionality provided by tlsdate ( https://github.com/ioerror/tlsdate ). They appear to have eschewed tlsdate's default approach of using the timestamp from the handshake in favor of usi
4.
by handsomeransoms 12y ago
Are you generating the User ID with the additional characters and expecting the user to remember/keep track of it? I do think that is very user-friendly, even with the cookie trick you describe. It seems like you are trying to force yo
5.
by handsomeransoms 12y ago
Part of the problem of running an exit node is that it's unclear how "safe" it actually is, and as a result there is a lot of rumor and paranoia. Every country has different laws that affect the legal status of an exit node o
6.
by handsomeransoms 12y ago
Clicked "Look: Try our latest demo version" and got a certificate error in Chrome :(
7.
by handsomeransoms 12y ago
minilock ( https://minilock.io/ ) intends to fill that exact niche. Have you tried it?
8.
by handsomeransoms 12y ago
FYI Google Chrome warns that imagebin.com "might contain malware".
9.
by handsomeransoms 12y ago
I think the title of this post is misleading. For context, see the summary of the amendment on p. 324, under "ACTION ITEM—Rule 41 (venue for approval of warrant for certain remote electronic searches)". The goal of this amendment
10.
by handsomeransoms 12y ago
Another (incorrect, but hilariously so) interpretation of the output of traceroute: http://youtu.be/SXmv8quf_xM
11.
by handsomeransoms 12y ago
Been using this for a minute, it's quite nice! Kudos to Nadim & team for a friendly and mostly intuitive UI, with some creative new ideas in the context of email/messaging. A few initial questions: 1. Is any part of the commun
12.
by handsomeransoms 12y ago
> With email, you're right that POP/IMAP on a dedicated box is preferable from a security standpoint. This depends on your threat model, and I'd argue that this statement is untrue for the vast majority of people, even peo
13.
by handsomeransoms 12y ago
Freedom of the Press Foundation https://freedom.press -- DevOps Engineer Full-time, Bay Area local preferred but remote possible for exceptional candidates. We develop SecureDrop, an open source whistleblower submission system.
14.
by handsomeransoms 12y ago
I think it's theoretically possible to use Service Workers to do this, giving you a TOFU trust guarantee, although I think there are some issues due to the spec-mandated auto-updating of Service Workers every 24 hours.
15.
by handsomeransoms 12y ago
> And Firefox's certificate API is not much better, only passive access without ability to block connections if you detect an unwanted cert. Nope. Firefox's Addon API lets you do pretty much whatever you want. It might be kind
16.
by handsomeransoms 12y ago
How many people are careful to type "https" every time they visit a website? How many people pay close attention to the lock icon/color of the URL bar? This advice seems to ignore the existence of sslstrip [0] and related att
17.
by handsomeransoms 12y ago
This is the problem that pinning is intended to solve.
18.
by handsomeransoms 12y ago
That's a common problem when using OTR with the same account in a multi-device environment. It is fixed by the introduction of instance tags in libotr 4.x [0]. You should check the versions of libotr used by all your clients - if they
19.
by handsomeransoms 12y ago
This reminds me of the recent (~2 months ago) addition of a new, very fast Tor relay (faster than any other relay at the time) that only relayed Bitcoin traffice [0]. Wonder if that has anything to do with this research, or if someone else
20.
by handsomeransoms 12y ago
You don't have to pick one or the other. According to the FAQ [0] (linked from the blog post): "In general, you’ll still be able to use a verification code the way you normally do on any device that doesn’t support Security Key.
21.
by handsomeransoms 12y ago
See https://bugzilla.mozilla.org/show_bug.cgi?id=1008706
22.
by handsomeransoms 12y ago
Great point, just a nit: Rust does not have mandatory GC.
23.
Help crowdfund independent media organizations to install SecureDrop(pressfreedomfoundation.org)
1 points by handsomeransoms 12y ago|0 comments
24.
by handsomeransoms 12y ago
> You are implying something fundamental: that the encrypted traffic could be adequately analysed for insight without the need for decryption. > Yet to do so would be to defeat SSL itself, or at least to declare it as insuffici
25.
by handsomeransoms 12y ago
Yeah, I'm having a hard time finding details on the vulnerabilities. A lot of the links in the advisories are broken, and the descriptions on the Mitre CVE pages seem to be awaiting update. Anybody know how to find better descriptions
26.
Debian Security Advisory: DSA-3025-1 apt(debian.org)
175 points by handsomeransoms 12y ago|64 comments
27.
by handsomeransoms 12y ago
Oh, yeah :/ The login page is over SSL, but everything after that is not (!!) This protects your password but not your OkCupid session cookies. It's an improvement over no SSL at all (which was the case for a long time) but stil
28.
by handsomeransoms 12y ago
Doesn't appear to work at all in Firefox 30 on Linux. Clicking one of the images after scrolling a bit (triggering the loading of additional content) leads to an infinitely spinning bar - no content ever loads. The same STR works witho
29.
by handsomeransoms 12y ago
(SecureDrop dev here) Glad you like it! It's hard to tell people who get excited about fun UX ideas that they can't use JS, but from my experience as a browser security engineer, eliminating JavaScript (and plugins, which the TBB
30.
by handsomeransoms 12y ago
Good idea, but, like many of these ideas, easier said than done.

More ›