zedred

5 ms·

1.
by zedred 9y ago
> If negotiating TLS 1.2, TLS 1.3 servers MUST set the last eight bytes of their Random value to the bytes: 44 4F 57 4E 47 52 44 01 If it is possible to do this safely, does that mean the TLS 1.2 Random value was always eight bytes too l
2.
by zedred 9y ago
Can you give us some examples?
3.
by zedred 9y ago
I haven't directly explored the source for either in little while, so I should take a new look. I might be a little out of date, but the things that I have seen second hand recently confirmed my earlier conclusions. Like I recently saw
4.
by zedred 9y ago
I was hopeful at first. A large VC funded company with a big full time team should run circles around a small open source effort, but their security is still way behind Signal. I was also quickly put off by their "less than honest&qu
5.
by zedred 9y ago
Probably worth mentioning this is a paid report for one library they use, not the Wire app.
6.
by zedred 10y ago
I think this study is exploring "persistent" ED, which is less known. ED is a documented side effect, but this shows that some men continue to experience ED even after they stop taking the drug.
7.
by zedred 10y ago
That's sort of too bad, because it looks like Signal was one of the only implementations they audited that had no issues. I hope these authors will eventually look at the new thing too.
8.
by zedred 10y ago
They don't use the signal protocol, they don't even use X3DH or Double Ratchet. That citation of yours is just a download link, not an actual reference to your point. The project is also kind of a mess. Check out their privacy po
9.
by zedred 10y ago
> As the article says, Bernstein's stuff won out because his work is at the intersection of solid crypto, clean and performant code, and sane API design. As a casual observer, my impression has been pretty different. Here's
10.
by zedred 10y ago
> It isn't because GnuPG doesn't work well or because it is too hard to use that people don't use it. They don't use it because other people don't use it. Sure, GnuPG works "well," for engineers. This
11.
by zedred 10y ago
I don't think that's true: https://whispersystems.org/bigbrother/eastern-virginia-grand...
12.
by zedred 10y ago
> GIF searches are obviously going to use a 3rd party service, and nobody should expect some kind of anonymous encrypted channel for GIF searches. That's ridiculous. GIF searches aren't being transmitted to a third party servic
13.
by zedred 10y ago
I recently switched from Android to iPhone and was pretty surprised by how much lower quality the Signal app is for iPhone than Android. Signal for Android was really amazing, and the switch made me think this could be one reason why so man
14.
by zedred 10y ago
You're promoting Wire for anonymity? Check out their privacy policy, Wire maintains a server side copy of your entire contact list, all the groups that you're in, the plaintext metadata for your groups (membership, plaintext grou
15.
by zedred 10y ago
That's like saying there's a targeted campaign to ignore Skype because these articles don't mention it. You might like Wire, but it's not an app that people concerned with privacy should be using. They have done a bunch
16.
by zedred 10y ago
Essays like these, along with Thanksgiving conversations with older extended family, are what really make me question the wisdom of eternal life. What if all the people stuck in the past like this were with us forever?
17.
by zedred 10y ago
Wire transmits your plaintext GIF search terms to the Wire server. Their privacy policy even allows those searches to be logged. Combined with Wire's already bad e2e encryption and metadata story, I don't see how you could consid
18.
by zedred 10y ago
> What Web2.0 did is that it removed the need of certain type of desktop software. The commonly held belief at the time was that Microsoft's dominance rested in large part on that desktop software. Think how hard it would be today
19.
by zedred 10y ago
"Near free" is expensive at that scale. Look at Twilio's S1, Twitter's costs can't be much lower than theirs.
20.
by zedred 10y ago
And think about how much this costs Twitter! The Fabric SDK allows apps to do phone number verification (SMS/Voice calls) for free . This is usually the single greatest cost associated with running any app that does phone number ver
21.
by zedred 10y ago
I don't know what kind of internal metrics would be telling a different story than the external metrics visible to us. The app store data alone is pretty damning, any growth they've had over the past few years is very slow linear
22.
by zedred 10y ago
Is the audio quality good enough to make hundreds of millions of people switch from WhatsApp? They've been trying for a few years, and it hasn't happened. I think open sourcing the apps is probably a last gasp, and we're li
23.
by zedred 10y ago
I didn't see that option, but either way the fact remains that even after several years, nobody is using the app. As a business with a large full time staff that needs considerable ongoing capital to continue, the numbers do not bode w
24.
by zedred 10y ago
I tried installing it and only had a single contact show up. And it turns out that contact had long since uninstalled the app (said it was very unreliable), but the server was still showing her as registered. From the app store numbers, it
25.
by zedred 14y ago
Agreed, I've had limited experience with the product and was disappointed. I think the above comments are correct, Twitter wanted them for the data not the talent.