Hacker News: galadran

New comment by galadran in "NSA tries to weaken mlkem standardisation?"

galadran — Fri, 03 Jul 2026 10:40:12 +0000

In effect, yes it does.

The Recommended flag is set for X25519MLKEM768. It is not set for any of the pure PQ key exchanges.

https://www.iana.org/assignments/tls-parameters/tls-paramete...

New comment by galadran in "NSA tries to weaken mlkem standardisation?"

galadran — Thu, 02 Jul 2026 20:26:00 +0000

I'm afraid you've misunderstood. These codepoints are for the pure MLKEM key establishment that DJB is railing against.

All of these libraries also support the hybrid forms, which have different codepoints and are used by default. Nothing in the IETF process has any bearing on this.

New comment by galadran in "NSA tries to weaken mlkem standardisation?"

galadran — Thu, 02 Jul 2026 17:31:41 +0000

This is garbage from start to finish.

There are already codepoints assigned for MLKEM 512/768/1024 (0x0200, 0x0201, 0x0202) and nearly every major library supports it already:

  - OpenSSL (ML-KEM-512/768/1024)
  - BoringSSL (ML-KEM-1024)
  - NSS (ML-KEM-1024)
  - AWS-LC (ML-KEM-512/768/1024)
  - Rustls (ML-KEM-768/1024)
  - s2n-tls (ML-KEM-1024)
  - Bouncy Castle (ML-KEM-512/768/1024)
  - Botan (ML-KEM-512/768/1024)
  - GnuTLS (ML-KEM-768/1024)
  - WolfSSL (ML-KEM-512/768/1024)

New comment by galadran in "Pact: Anonymous Credentials for the Web"

galadran — Tue, 23 Jun 2026 22:41:30 +0000

> If nothing changes, users will increasingly be forced to choose between their privacy and their access to the web

Shorter post: https://blog.mozilla.org/en/privacy-security/keeping-the-web...

New comment by galadran in "Cloudflare Collaborates with Leading Browsers to Develop Privacy-First Protocol"

galadran — Tue, 23 Jun 2026 21:35:27 +0000

More details: https://blog.mozilla.org/en/privacy-security/keeping-the-web...

Keeping the Web Open and Private in the Bot Era

galadran — Tue, 23 Jun 2026 16:04:23 +0000

Article URL: https://blog.mozilla.org/en/privacy-security/keeping-the-web-open-and-private-in-the-bot-era/

Comments URL: https://news.ycombinator.com/item?id=48647131

Points: 6

# Comments: 0

New comment by galadran in "EU Council and Parliament reach agreement for approving controversial eIDAS law"

galadran — Thu, 09 Nov 2023 10:33:43 +0000

EU Commission FAQ (emphasis mine):

Recognition means that web browsers are required to ensure support and interoperability for the QWAC for the sole purpose of displaying identity data in a user-friendly manner. *Recognition of QWACs implies that browsers shouldn't question the origin, integrity or data in the certificate*.

However, the requirement to recognise QWACs does not affect browser security policies and leaves web browsers free to preserve their own procedures and criteria for encryption and authentication of *other certificates*.

https://ec.europa.eu/commission/presscorner/detail/en/QANDA_...

New comment by galadran in "Joint statement of scientists and NGOs on the EU’s proposed eIDAS reform"

galadran — Fri, 03 Nov 2023 14:06:14 +0000

As I commented there, you've misunderstood this change.

There's a difference between certificates distributed with the OS and certificates added to the OS by a user. Right now Firefox ignores both.

This change ONLY picks up the certificates added to the OS by a user. Firefox will continue to ignore the certificates included with the OS store by default.

New comment by galadran in "Firefox Beta 120 trusts OS certificates by default"

galadran — Fri, 03 Nov 2023 14:05:03 +0000

There's a difference between certificates distributed with the OS and certificates added to the OS by a user. Right now Firefox ignores both. This change ONLY picks up the certificates added to the OS by a user.

New comment by galadran in "Last Chance to fix eIDAS: Secret EU law threatens Internet security"

galadran — Thu, 02 Nov 2023 10:48:26 +0000

"Agreed behind closed doors" would probably be better than "Secret Law" but I guess its a question of brevity.

New comment by galadran in "Last Chance to fix eIDAS: Secret EU law threatens Internet security"

galadran — Thu, 02 Nov 2023 10:47:17 +0000

https://en.wikipedia.org/wiki/Formal_trilogue_meeting

New comment by galadran in "Last Chance to fix eIDAS: Secret EU law threatens Internet security"

galadran — Thu, 02 Nov 2023 09:48:09 +0000

https://eidas-open-letter.org

The open letter signed by 300+ researchers, professors and experts.

New comment by galadran in "Last Chance to fix eIDAS: Secret EU law threatens Internet security"

galadran — Thu, 02 Nov 2023 08:48:05 +0000

Title should probably be: "Last Chance to fix eIDAS: Secret EU law threatens Internet security"

New comment by galadran in "Last Chance to fix eIDAS: Secret EU law threatens Internet security"

galadran — Thu, 02 Nov 2023 08:33:36 +0000

https://last-chance-for-eidas.org/

New comment by galadran in "Firefox Beta 120 trusts OS certificates by default"

galadran — Wed, 25 Oct 2023 12:28:50 +0000

This isn't the right summary. Firefox uses it own root store still and ignores any certificates distributed by default in the OS. However, if the user installs their root to the OS, Firefox will also pick it up. This is how other browsers work.

New comment by galadran in "Encrypted Client Hello (ECH) Effectively Defeats Pirate Site Blocking"

galadran — Fri, 06 Oct 2023 18:26:07 +0000

Mozilla's launch earlier this week: https://blog.mozilla.org/en/products/firefox/encrypted-hello...

New comment by galadran in "Encrypted Client Hello"

galadran — Fri, 29 Sep 2023 15:23:41 +0000

I believe CF and others buckled under pressure from major websites which didn't want to be used as fronts for other website's traffic. ECH fixes this because individual sites get to opt-in to using it.

New comment by galadran in "Encrypted Client Hello"

galadran — Fri, 29 Sep 2023 15:22:09 +0000

Any provider can deploy ECH, it's standardized at the IETF. Cloudflare are just first.

New comment by galadran in "Encrypted Client Hello"

galadran — Fri, 29 Sep 2023 15:19:10 +0000

The point is that network operators can't tell which website the user is visiting, as it could be any of the sites hosted by the ECH provider.

In this case, Cloudflare are acting as the ECH provider and as they already host the websites, they already see the connection plaintext.

New comment by galadran in "This shouldn't have happened: A vulnerability postmortem"

galadran — Wed, 01 Dec 2021 19:28:37 +0000

The disclosure and test cases: https://www.openwall.com/lists/oss-security/2021/12/01/4