Hacker News: AnaniasAnanas

New comment by AnaniasAnanas in "Opmsg – A GPG Alternative"

AnaniasAnanas — Tue, 23 Jul 2019 12:31:36 +0000

Banks are not known for using the best/safest solutions. Just take 4 digit pins and 3DES into account for example.

> who only offer certs of RSA and P-{256,384}?

I am pretty sure that nginx and openssl only recently added support for ed25519 certificates. Although to be honest I don't really like the idea of let's encrypt. The addressing system that tor uses has solved that issue already.

> but where most browsers use secp256r1?

This is an issue. Browser vendors should prioritize the djb algorithms.

New comment by AnaniasAnanas in "Opmsg – A GPG Alternative"

AnaniasAnanas — Fri, 19 Jul 2019 18:48:55 +0000

Nobody was ever fired for using DJB. Meanwhile I would gladly fire someone for using AES128 or the NSA-sponsored curves, despite being in Suite B.

New comment by AnaniasAnanas in "Opmsg – A GPG Alternative"

AnaniasAnanas — Fri, 19 Jul 2019 18:44:15 +0000

> some of them do involve using RSA with absurd key sizes and they'll likely fail the competition.

Only one (specifically DJBs joke Post-QC algorithm), and it did not pass to the second round.

New comment by AnaniasAnanas in "Opmsg – A GPG Alternative"

AnaniasAnanas — Fri, 19 Jul 2019 18:34:24 +0000

> WhatsApp, Telegram and Signal use mobile phone numbers as identifiers

One notable exception (which as I understand is tptacek-approved) is Wire, which only needs an email.

New comment by AnaniasAnanas in "Opmsg – A GPG Alternative"

AnaniasAnanas — Fri, 19 Jul 2019 18:31:59 +0000

> Nobody actually wants to rely on a single entity (for or non-profit) for their communication

You don't have to do that. Protocols like tox for example are distributed and use DHT in order to find peers.

New comment by AnaniasAnanas in "SKS Keyserver Network Under Attack"

AnaniasAnanas — Sun, 30 Jun 2019 15:15:35 +0000

It's even worse than it seems. The certificates are only a few megabytes long. https://twitter.com/FiloSottile/status/1145091106138394625

New comment by AnaniasAnanas in "SKS Keyserver Network Under Attack"

AnaniasAnanas — Sun, 30 Jun 2019 00:07:55 +0000

Both Signal and Wire are FOSS though.

New comment by AnaniasAnanas in "SKS Keyserver Network Under Attack"

AnaniasAnanas — Sat, 29 Jun 2019 18:47:15 +0000

As much as I believe that Efail was the result of badly implemented email clients it's not like the OpenPGP standard hadn't any involvement with it whatsoever. DJB for example suggests small authenticated and encrypted packets, something that OpenPGP does not have. See https://groups.google.com/forum/#!original/boring-crypto/BpU...

Since I am apparently replying too fast and I need to slow down, here is my reply to the child post by Sir_Cmpwn:

> I don't really see the link between the email you posted and efail

GPG decrypts the whole message which might be gigaoctets long and throws it to the output. After it has been decrypted it checks the MDC (if it exists) and throws an error if the MDC does not match or if it is missing. Meanwhile if a OpenPGP message was composed of small authenticated packets GPG would be able to first authenticate if the MAC of the packet is correct and then return an error right away if it does not match. If it did match it would return plaintext and move on to the next packet. You can see now how efail would be prevented, right?

> PGP

Do people use PGP nowadays? I was under the impression that pretty much everyone used GPG ever since it was released.

New comment by AnaniasAnanas in "TeXmacs 1.99.1"

AnaniasAnanas — Sat, 29 Jun 2019 17:48:04 +0000

I tried exporting org-mode to latex in the past and found it extremely buggy. I don't really see a reason not to just directly use LaTeX instead.

New comment by AnaniasAnanas in "Schools are using unproven surveillance technology to monitor students"

AnaniasAnanas — Sat, 29 Jun 2019 17:32:42 +0000

*Everywhere. My own school experience in Europe was pretty much the same as he described. And it is not only my school experience either, there were many cases of unpunished power abuse that the teachers engaged in in nearby schools.

New comment by AnaniasAnanas in "Schools are using unproven surveillance technology to monitor students"

AnaniasAnanas — Sat, 29 Jun 2019 17:28:57 +0000

The schools that I went to had around 300 students. It did not stop the abuse by teachers nor did it stop the bullying that the teachers ignored.

New comment by AnaniasAnanas in "SKS Keyserver Network Under Attack"

AnaniasAnanas — Sat, 29 Jun 2019 17:11:28 +0000

OCaml is very popular in academia though, especially in the field of theoretical computer science and formal verification. Coq, Frama-C, Flow, CompCert, etc are all written in OCaml. Heck, if you are running a graphical GNU distribution chances are that you have installed FFTW, which is written in OCaml. The "industry" is not the only thing that matters when considering the adoption of a language.

New comment by AnaniasAnanas in "SSH gets protection against side-channel attacks"

AnaniasAnanas — Sat, 22 Jun 2019 13:07:05 +0000

No offense, I am genuinely curious, why would anyone use any closed source software for anything related to security after the Snowden revelations?

New comment by AnaniasAnanas in "MIPS R3000"

AnaniasAnanas — Thu, 20 Jun 2019 18:37:26 +0000

Why does everyone seem to hate delay slots? I understand that it makes writing assembly more annoying but most people use a compiler anyway.

New comment by AnaniasAnanas in "Firefox zero-day was used in attack against Coinbase employees, not its users"

AnaniasAnanas — Thu, 20 Jun 2019 18:21:24 +0000

A better question would be: why were Coinbase employees allowed to use any browser with javascript enabled and outside of a VM? Qubes OS has been a thing for quite a while.

New comment by AnaniasAnanas in "Firefox zero-day was used in attack against Coinbase employees, not its users"

AnaniasAnanas — Thu, 20 Jun 2019 18:19:23 +0000

I mentioned the possibility of an untrustworthy person gaining access to bugzilla yesterday but it seems that most people disagreed with it: https://news.ycombinator.com/item?id=20221397

New comment by AnaniasAnanas in "Hit by Ransomware Attack, Florida City Agrees to Pay Hackers $600k"

AnaniasAnanas — Thu, 20 Jun 2019 18:16:51 +0000

The voters are not one person. Sadly democracy ends up being the fascism of the many.

New comment by AnaniasAnanas in "Hit by Ransomware Attack, Florida City Agrees to Pay Hackers $600k"

AnaniasAnanas — Thu, 20 Jun 2019 14:18:46 +0000

Whoever made the decision not to take backups for example. The ones who will have to pay for their mistakes will be the taxpayers otherwise.

New comment by AnaniasAnanas in "Hit by Ransomware Attack, Florida City Agrees to Pay Hackers $600k"

AnaniasAnanas — Thu, 20 Jun 2019 09:16:21 +0000

Shouldn't the one responsible personally have to pay for it rather than the city and its taxpayers?

New comment by AnaniasAnanas in "Facebook moderators break NDAs to expose working conditions"

AnaniasAnanas — Wed, 19 Jun 2019 13:14:44 +0000

> It needs to be possible to hire people that you trust not to disclose all your secrets, and your customer's secrets

I disagree, it needs to be possible for whistle-blowers to operate freely. It should also be possible to disclose to the whole world new and superior techniques and technologies that a company tries to hide.

> This is what privacy regulations are all about

I am pretty sure that this is a separate thing to NDAs. Nevertheless I believe that the solution should be technical rather than legal, with things like end to end encryption and public key cryptography.