<rss version="2.0" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:atom="http://www.w3.org/2005/Atom"><channel><title>Hacker News: mnordhoff_</title><link>https://news.ycombinator.com/user?id=mnordhoff_</link><description>Hacker News RSS</description><docs>https://hnrss.org/</docs><generator>hnrss v2.1.1</generator><lastBuildDate>Tue, 28 Apr 2026 08:43:56 +0000</lastBuildDate><atom:link href="https://hnrss.org/user?id=mnordhoff_" rel="self" type="application/rss+xml"></atom:link><item><title><![CDATA[New comment by mnordhoff_ in "Sources: We were pressured to weaken mobile security in the 80's"]]></title><description><![CDATA[
<p>Matthew Green wrote about GSM and LTE a few months ago:<p><a href="http://blog.cryptographyengineering.com/2013/05/a-few-thoughts-on-cellular-encryption.html" rel="nofollow">http://blog.cryptographyengineering.com/2013/05/a-few-though...</a><p>TL;DR: GSM security is a joke. LTE is okay, except for two critical issues: One, an attacker can jam LTE and cause a downgrade to GSM. Two, it doesn't offer forward secrecy, so an attacker can record your traffic, obtain the private key from your carrier, and decrypt it. It's a reasonable assumption that NSA and your local sigint agency routinely make copies of your carrier's key database.<p>Edit: Reword last sentence.</p>
]]></description><pubDate>Fri, 10 Jan 2014 13:19:49 +0000</pubDate><link>https://news.ycombinator.com/item?id=7036411</link><dc:creator>mnordhoff_</dc:creator><comments>https://news.ycombinator.com/item?id=7036411</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=7036411</guid></item><item><title><![CDATA[New comment by mnordhoff_ in "NSA infiltrates links to Yahoo, Google data centers worldwide"]]></title><description><![CDATA[
<p>IIRC, Poland was the EU country that was the focus of attention.<p>Skimming Wikipedia's most definitely totally truthy article on the subject [1] (actually, it has a lot of citations, so it should be easy to verify), the UK's only alleged black site was the US base on Diego Garcia, which is "UK", but not "basement in London".<p>[1] <a href="https://en.wikipedia.org/wiki/Black_site#Suspected_black_sites" rel="nofollow">https://en.wikipedia.org/wiki/Black_site#Suspected_black_sit...</a><p>Edit (T+18 minutes): Wikipedia lists numerous other European countries as possibly being involved. Information is really sketchy -- they <i>are</i> called "black" sites. Another question is which officials in the lucky host countries even <i>knew</i> about it.</p>
]]></description><pubDate>Thu, 31 Oct 2013 03:31:57 +0000</pubDate><link>https://news.ycombinator.com/item?id=6645058</link><dc:creator>mnordhoff_</dc:creator><comments>https://news.ycombinator.com/item?id=6645058</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=6645058</guid></item><item><title><![CDATA[New comment by mnordhoff_ in "Ask HN: Buffer got hacked - does anyone know details?"]]></title><description><![CDATA[
<p>Public Service Announcement: "SHA1(password+salt)" is an extremely unsafe way to store passwords. Use PBKDF2, bcrypt or scrypt.<p>Edit (T+7 minutes): Rewritten to not be a jerk.</p>
]]></description><pubDate>Sat, 26 Oct 2013 20:40:09 +0000</pubDate><link>https://news.ycombinator.com/item?id=6619232</link><dc:creator>mnordhoff_</dc:creator><comments>https://news.ycombinator.com/item?id=6619232</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=6619232</guid></item><item><title><![CDATA[New comment by mnordhoff_ in "Why Android SSL was downgraded from AES256-SHA to RC4-MD5 in late 2010"]]></title><description><![CDATA[
<p>Nginx has an equivalent preference,  ssl_prefer_server_ciphers on. (Scroll down a bit on evmar's link.)</p>
]]></description><pubDate>Mon, 14 Oct 2013 19:28:51 +0000</pubDate><link>https://news.ycombinator.com/item?id=6549100</link><dc:creator>mnordhoff_</dc:creator><comments>https://news.ycombinator.com/item?id=6549100</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=6549100</guid></item></channel></rss>