Viewing profile — analogist

Ah yes, enforcing the law, which, “in its majestic equality, forbids rich and poor alike to sleep under bridges, to beg in the streets, and to steal their bread.”

So you think there is no difference in guilt between being a war criminal’s arm dealer and being a war criminal’s grocer?

> PS: your mention of that Twitter account is creepy. With no context, I agree. But I'm not exactly stalking engineers here - there was literally a direct link to that twitter from…

Hi Bron. I'm a customer of both Fastmail and GSuite, and I have enjoyed your service for a few years now. I still use Fastmail for some things, like sieve, and very much will conti…

> I’m not willing to stick my neck out > empathy gap Maybe if you were more open to helping them with threats to their livelihood, dignity, and well-being, they’d be more open to h…

@bascule addresses deterministic password managers as a category here: https://tonyarcieri.com/4-fatal-flaws-in-deterministic-passw... Certainly you’ve considered these points, and…

This is so obvious that the first thing I would do is look to see if they've addressed it in some way, instead of assuming incompetence. If you have gone through the process of bei…

Because they don't transmit your encryption password. Authentication is not done by sending them your encryption password, but instead the derivation of an SRP static secret ( http…

That's pretty much correct, yeah. Due to exponentiation, length is almost everything in password security. Which means there's going to be a bunch of lengths at which brute force c…

Wow. This is yet another example of the fatal combination of Rolling Your Own Crypto + Using OpenSSL Directly And Blowing Your Own Foot Off Because It Lets You. var cipher = crypto…

Even conventional VPN is not enough. The Great Firewall of China ( https://en.wikipedia.org/wiki/Great_Firewall ) is a mix of DNS poisoning, deep packet inspection, and traffic and…

Summary link by OSTIF, which includes a quick synopsis of both audits, and link to full report on OpenVPN 2.4 by OSTIF: https://ostif.org/the-openvpn-2-4-0-audit-by-ostif-and-quark…

So you would be fine with your local restaurant "denying service" and locking the doors only when the food safety inspectors show up?

That seems to be pretty weak evidence of verification not being through TLS. There could easily be an additional connectivity check that is http-based (that was blocked by the capt…

I think a recurrent concern is OpenVPN's reliance on TLS, and its codebase complexity as a result of being built on OpenSSL--but with far less attention and resources and vuln hunt…

I'm no expert, but intuitively it would seem that encryption-inside-encryption would be snake oil when they're meant to guard against the same layer/attack vector/threat model: for…

Inside of TLS, 1Password uses an additional SRP handshake that negotiates a static secret (like a DHE), which 1Password uses to both authenticate the user and set up an additional …

As a neuroengineer working in the field, this is quite accurate. Understanding the compute architecture goes a loooong way - after all, acoustic RSA key extraction ( https://www.ta…

Isn't that's just a description of all TLS? ECDHE/DHE key exchange is essentially employed on any non-poorly configured modern https site, TLS 1.0-1.3draft.

What can a technologist do about climate change? (2015) http://worrydream.com/ClimateChange/ TL;DR: better energy production/transportation methods, data-driven tools for finding b…

I'm not sure where all the aggression and distrust comes from, but if you had done a a simple search, you would easily see that your points are false. 1) a) Every single line shown…

The symmetric algorithm aside, if we just look at the key derivation, the --s2k* parameters go up to 65011712 rounds of SHA512. If you maxed out the --s2k* settings, its difference…