qrmn

8 ms·

1.
by qrmn 10y ago
I think it might have rolled out already. Turn on Developer Mode in Windows 10 Anniversary Edition, and ssh to port 22 with a valid l/p? Doesn't look like you even need to install WSL.
2.
by qrmn 10y ago
More permanent than a van. (Not that unusual for an embassy to be spied on!) It might have something to do with the IMSI catcher installed more or less across the road; hard to hide those, they broadcast, and that one is not particularly tr
3.
by qrmn 10y ago
Respectably, no tool - be it I2P's garlic routing, Tor's onion routing or anything else - could ever provide "complete untraceable anonymity"; that is a huge (and potentially very harmful) misunderstanding of what these
4.
by qrmn 10y ago
Absolutely. I built a concept that essentially did that. Separated program and data memory with only one executable. USB host would get (in hardware) an outright memory dump of the program memory on connection, so it could hash it/comp
5.
by qrmn 11y ago
This is a hash function (as used in hash tables/Bloom filters and so forth), but it is not a cryptographic hash function. It is designed to be very fast for things like table lookups, but it is not designed to be strongly resistant to
6.
by qrmn 11y ago
I've experimented with doing this kind of thing myself, especially with servers where I don't have ready access to the console and where the provider doesn't offer custom ISO support and I wanted a clean (and/or customis
7.
by qrmn 11y ago
XML was probably a mistake. Strong, deniable, end-to-end encryption should be mandatory. The Axolotl ratchet is the current state-of-the-art: maybe it does asymmetric things we don't need, or maybe that's helpful. Looking forward:
8.
by qrmn 11y ago
As far as I'm aware, Yubikey 4 and Yubikey Nano 4 can do 4096; the older ones like the NEO can only do 2048. Not that 2048 is flawed as such: it's still north of 100 bits workfactor at the moment, as far as I gather. 3072 would be
9.
by qrmn 11y ago
Sybil is a real pain, and HashCash (via I2P, which had it as an anti-DoS option) was the first obvious attempt at a solution that worked. It would be better done with Argon2 now, but it still burns coal and is a bet that evil nodes don&#x2
10.
by qrmn 11y ago
I do have an "invite" prompt on my SMS contacts that don't yet have Signal: "Invite to Signal: Take your conversation with %s to the next level.". Perhaps it's a function in the beta version that isn't in
11.
by qrmn 11y ago
Automatic contact discovery is tricky, but the beginnings of one potential solution is I think explored in agl's Pond, using pairings on BN curves?: https://pond.imperialviolet.org/ To a point, so is offline messaging.
12.
by qrmn 11y ago
Impossible is a strong word - one prefers to reserve that for provably doomed problems like DRM - but several common, simple paradigms do present an unexpected technical challenge, or even an open research problem, or need to be expressed s
13.
by qrmn 11y ago
I wish that were true, but honestly, plaintext isn't fine for anything at all in 2015, whether authenticated, important, public or otherwise, whether the network is the internet or a LAN. HTTP sites have had attack scripts injected int
14.
by qrmn 11y ago
I just use Diceware: https://qrmn.uk/dwr/ (With thanks to Alyssa Rowan for the CSPRNG design. Public domain - feel free to copy it.) For really important stuff, actual dice just to make sure.
15.
by qrmn 11y ago
This is a very solid point. We already had an open cryptographic competition to select a password hashing standard, and we have a winner: Argon2 is being developed as a new standardised password hash (i.e. slow-hash). If you're going t
16.
by qrmn 11y ago
I used it. It's not as fast an approach as it sounds; you want to do hitbox collision first. But if there's a better way to really do pixel-perfect collision, I couldn't figure it out - maybe subdividing hitboxes would have b
17.
by qrmn 11y ago
Of course, the Elligator and related mappings allow for (a subset of) valid curve points to be mapped to indistinguishable bit strings, which is very handy in some protocols. A backdoor merchant using Elligator 2, or Elligator Squared, in t
18.
by qrmn 11y ago
I'm going to recommend deadlisting/disassembly instead. Network analysis doesn't give as much context for exactly what is sent, and there seems to be - as far as I can see, yet? - a total lack of hard data and verifiable ev
19.
by qrmn 11y ago
That is incorrect. From the EULA [§4(b)], it is clear that upgrades from retail (stand-alone) versions stay retail - and transferable. No exceptions in there about the one-year qualifying period to upgrade your (now-perpetual) Windows licen
20.
by qrmn 11y ago
Both Xiph's Daala and Cisco's Thor projects are contributing to the NetVC Working Group at IETF - https://datatracker.ietf.org/wg/netvc/charter/ - to attempt to create a new, competitive, royalty-fr
21.
by qrmn 11y ago
The point I'm making is that people should probably balk at the suggestion that they need 200Mbps/sec of entropy from a mysterious black box on a PCIe card sold to them by an NSA affiliate who want them to put it into their critic
22.
by qrmn 11y ago
Honestly, this sales brochure of a "paper" tastes even worse than the BBC fluff piece. This is below the standard of paper I would have expected Black Hat to accept. Good CSPRNG design is not a "dark art", and entropy is
23.
by qrmn 11y ago
There are few enough IPv4 addresses that just about any hash forms an injective mapping which can be completely reversed: the best you can do is use something like HMAC and "pepper" it, but that only works if the clients can'
24.
by qrmn 11y ago
A policy which unfortunately lumps DoS in with remote code execution as both "high". They're both significant, but one's clearly going to give us all a much worse day than the other, so we're all still left to won
25.
by qrmn 11y ago
I think what the grandparents is wondering is if Hacking Team have a 0day in OpenSSL which this will fix, or is the timing coincidental? (I don't know the answer, but if they did, it's probably in that 400GB dump.) I'm mostly
26.
by qrmn 11y ago
I do remember disassembling it and looking at it from the other way! (I was curious.) Pre-emptive multi-tasking kernels at that level weren't things you saw frequently on consoles then. Many people just hung things off the vertical bla
27.
by qrmn 11y ago
Fascinating insights. Lots of music on the PSX used a system like that, because that's a very natural fit for the PSX SPU. Tracker "modules" combine the sample data and tabulated sequencing data, but what you found more often
28.
by qrmn 11y ago
Indeed, the old FTL game, Dungeon Master (an old RPG, its most direct modern successor-by-inspiration being Legend of Grimrock) put some copy-protection code in one of its sprites, where it hoped you wouldn't notice. One part of it wou
29.
by qrmn 11y ago
I gather they're not launching with ECDSA certificates (and obviously not with EdDSA or whatever comes out of CFRG, because that's still being discussed by the IETF/IRTF), but they're going to add it later. Any idea when
30.
by qrmn 11y ago
(This is not legal advice, just a comment.) No, the "under penalty of perjury" bit in the DMCA is that they own the copyright in the content they're saying they own. (I believe this is undisputed; they do in fact own the ty

More ›