Viewing profile — handsomeransoms

Whether or not this is acceptable depends on your threat model. If you believe your adversary might compromise or coerce the service operator, then you cannot trust in-browser encr…

This is very similar to the functionality provided by tlsdate ( https://github.com/ioerror/tlsdate ). They appear to have eschewed tlsdate's default approach of using the timestamp…

Are you generating the User ID with the additional characters and expecting the user to remember/keep track of it? I do think that is very user-friendly, even with the cookie trick…

Part of the problem of running an exit node is that it's unclear how "safe" it actually is, and as a result there is a lot of rumor and paranoia. Every country has different laws t…

Clicked "Look: Try our latest demo version" and got a certificate error in Chrome :(

minilock ( https://minilock.io/ ) intends to fill that exact niche. Have you tried it?

FYI Google Chrome warns that imagebin.com "might contain malware".

I think the title of this post is misleading. For context, see the summary of the amendment on p. 324, under "ACTION ITEM—Rule 41 (venue for approval of warrant for certain remote …

Another (incorrect, but hilariously so) interpretation of the output of traceroute: http://youtu.be/SXmv8quf_xM

Been using this for a minute, it's quite nice! Kudos to Nadim & team for a friendly and mostly intuitive UI, with some creative new ideas in the context of email/messaging. A few i…

> With email, you're right that POP/IMAP on a dedicated box is preferable from a security standpoint. This depends on your threat model, and I'd argue that this statement is untrue…

Freedom of the Press Foundation https://freedom.press -- DevOps Engineer Full-time, Bay Area local preferred but remote possible for exceptional candidates. We develop SecureDrop, …

I think it's theoretically possible to use Service Workers to do this, giving you a TOFU trust guarantee, although I think there are some issues due to the spec-mandated auto-updat…

> And Firefox's certificate API is not much better, only passive access without ability to block connections if you detect an unwanted cert. Nope. Firefox's Addon API lets you do p…

How many people are careful to type "https" every time they visit a website? How many people pay close attention to the lock icon/color of the URL bar? This advice seems to ignore …

This is the problem that pinning is intended to solve.

That's a common problem when using OTR with the same account in a multi-device environment. It is fixed by the introduction of instance tags in libotr 4.x [0]. You should check the…

This reminds me of the recent (~2 months ago) addition of a new, very fast Tor relay (faster than any other relay at the time) that only relayed Bitcoin traffice [0]. Wonder if tha…

You don't have to pick one or the other. According to the FAQ [0] (linked from the blog post): "In general, you’ll still be able to use a verification code the way you normally do …

See https://bugzilla.mozilla.org/show_bug.cgi?id=1008706

Great point, just a nit: Rust does not have mandatory GC.

> You are implying something fundamental: that the encrypted traffic could be adequately analysed for insight without the need for decryption. > Yet to do so would be to defeat SSL…

Yeah, I'm having a hard time finding details on the vulnerabilities. A lot of the links in the advisories are broken, and the descriptions on the Mitre CVE pages seem to be awaitin…