maxtaco

7 ms·

1.
by maxtaco 5mo ago
Use extreme caution running arbitrary code on your machines, especially obfuscated code that tickles kernel bugs! (edited)
2.
by maxtaco 5mo ago
Backpointers to earlier epochs in append-only cryptographic data structures like key transparency logs. If the client last fetched epoch 1000, and the server reports the current epoch is 3000, the server can return log(2000) intermediate ep
3.
by maxtaco 5mo ago
Amazing man, with many important contributions over a very long career. The Rabin Cryptosystem (like RSA, but with public exponent 2) is notable for two reasons. First, unlike RSA, it is provably as hard as "factorization" (as he
4.
Federated, End-to-End Encrypted Document Storage with Git(blog.foks.pub)
1 points by maxtaco 5mo ago|0 comments
5.
Tax Day? Git add 1040.pdf(blog.foks.pub)
3 points by maxtaco 5mo ago|0 comments
6.
by maxtaco 6mo ago
I think in practice it doesn't work to deserialize only verified data. Snowpack has a mechanism for this but I found it impractical to require all use cases fit this form. I'm not sure exactly what system you're describing, b
7.
by maxtaco 6mo ago
Bingo!
8.
by maxtaco 6mo ago
It seems like in that PR, the fact that the OID wasn't checked is part of the problem. I think a better system wouldn't compile or would always fail to verify if the OID (domain separator) is wrong, and I think you'd get that
9.
by maxtaco 6mo ago
Hi, post author here. Agree that the idea isn't tricky, but it seems like many systems still get it wrong, and there wasn't an available system that had all the necessary features. I've tried many of them over the years -- XD
10.
by maxtaco 6mo ago
It should be possible to change the name of the type, and this happens often in practice. But type renames shouldn't break preexisting signatures. In this scheme you are free change the type name, and preexisting signatures still verif
11.
by maxtaco 6mo ago
I would say two problems with the asn.1 approach are: (1) it seems like too much cognitive overload for the OIDs to have semantic meaning, and it invites accidental reuse; I think it matters way more that the OIDs are unique, which randomne
12.
by maxtaco 8mo ago
Also on the front page of HN right now is a job posting for Optery (YC W22). Seems like they are growing really fast.
13.
by maxtaco 9mo ago
An intended use case for FOKS ( https://foks.pub ) is to allow long-lived durable shared secrets between users and teams with key rotation when needed.
14.
The Anti-Tail of 3I/Atlas Turned to a Tail(avi-loeb.medium.com)
2 points by maxtaco 11mo ago|0 comments
15.
by maxtaco 1y ago
I think one could build something nice on top of FOKS ( https://foks.pub ).
16.
by maxtaco 1y ago
No incremental fetch right now other than what postgresql provides by default. If you're hosting a FOKS server, there is important metadata to backup too. The best docs for the KV store are in the white paper, Section 5.1. White paper
17.
by maxtaco 1y ago
An attack that might be of concern with this configuration is the server suppressing updates to this JSON file, or showing different versions of the JSON file to different clients. What you're describing is pretty close to what FOKS is
18.
by maxtaco 1y ago
Thanks for these great questions! - limiting users to delete/push/force; this is possible but I don't see how to cryptographically guarantee it. The server can't really help since it doesn't know what's a pack,
19.
by maxtaco 1y ago
This would be a great application for us! We are not exactly there yet, for reasons of privacy. Right now, there is no way for alice@host to allow unauthenticated users to view her profile. But we can definitely allow this on a host-by-host
20.
by maxtaco 1y ago
Easy multi-accounting is something that I hope we already have (`foks key switch` is pretty smooth). It's a feature I use a lot (I have a personal account on @foks.app and our company account is on @ne43.foks.cloud). This is a great po
21.
by maxtaco 1y ago
Thanks Danny! The Keybase team (not including me) deserves all the credit, I've been gone for over six months. It's a great team and I miss working with them.
22.
by maxtaco 1y ago
Thanks! Would love to see a file sync app, an MLS-based chat (where the encryption key is essentially a combination of the keys output from MLS and the PTK from FOKS). Password managers. I think there's the potential for something like
23.
by maxtaco 1y ago
I'm not familiar with Radicle, but I'll check it out. For (1), consider the case of that server being hosted on AWS. Even though only members are authorized to SSH into it, the plaintext is still known to the cloud hardware, and c
24.
by maxtaco 1y ago
It's not as seamless. You need to first make a team, then invite (or add) that user into the team, and then use `foks kv put --team <your-team>`. One key difference is that in Keybase, all user's profiles were essentially wo
25.
by maxtaco 1y ago
Correct! Remote members of the team get access to shared team keys, and the team's data, even though they don't have accounts on that server. Knowledge of the team key suffices to allow a remote user to authenticate and transfer (
26.
by maxtaco 1y ago
E2E-encrypted git. Keybase has KBFS, and FOKS has a poor man's equivalent, which is E2E-encrypted Key-value store.
27.
by maxtaco 1y ago
Max here, author of FOKS. I find it interesting how much glue is required to perform basic cryptographic operations, even in 2025. Imagine a very simple idea like encrypting a secret with a YubiKey. If it's an important secret, that yo
28.
by maxtaco 4y ago
- Sorry about the outage yesterday. It lasted about 1 hour but service was promptly restored. - As Zoom employees, our primary objective is now to bring the technology at play in Keybase to Zoom products. - We are still making regular updat
29.
by maxtaco 6y ago
Note that the implementation of EdDSA that the authors investigated (libgcrypt) is not a constant-time implementation. Better implementations are more likely to be safe. See: https://news.ycombinator.com/item?id=21352821
30.
by maxtaco 6y ago
Congratulations and thank you for posting this inspirational story! I became interested in programming 26 years ago after taking the same class you did. So thanks to David Malan and his forebearer Margo Seltzer for CS50.

More ›