Viewing profile — trash_panda

Not only do they not address the technical aspects of the paper, their response starts with a direct personal attack: "It seems Nadim (the author of this paper) took it really badl…

The analysis by Kobeissi is correct, and the claims by ProtonMail are a stretch, and sometimes they don't mean anything. For example, from their security details page [1]: "This me…

You can actually see what code your browser is running, you have view source and all the developer tools to analyze the JS code. This is their main defense, they will probably post…

I think what he means with certifications is that they'll get you the jobs you don't really want. For example, CEH (Certified Ethical Hacker) is a certification you'll see in a lot…

Of course, you're welcome. I forgot to address the salary question. Six figure jobs are common in this industry, but experience is required to get those jobs. I don't personally kn…

First of all: what in particular do you find interesting of the security field? Are you more interesting in the offensive or defensive side? I guess that given your background, the…

This is really useful for security testing, where unexpected input could have security implications. There is a similar project, which I think is better organized and has more list…

Agree, but I also read this as a little condescending towards Chinese workers. We tend to attribute their success to corruption, exploitation, or brute-force (given their populatio…

There is no such thing as a "standard threat model". That's why the threat modeling concept exists in the first place, so you can adapt different solution to different requirements…

Privacy and security are intertwined. I believe Signal's decisions are based on the objective of making secure communications easy. If they catered to what some people want (no pho…

Google tracks you, yes. But Google also takes good measures to ensure that they are the only ones that can track you (and the Google Play apps of course). You may be obsessed with …

From their first blog post [1]: "We’re not placing any particular bounds on this project and will work to improve the security of any software depended upon by large numbers of peo…

Actually, you're both incorrect. It's "plata o plomo". "Plata" can mean "silver" or "money". In this context they are referring to "money". "Plato" is literally "plate" as in where…

It isn't a matter of whether it's "secure" or not. The problem is that their security model is based around JavaScript code being pushed to your browser where all the "cryptography…

Holy, I forgot about that one! You're totally right and I'm surprised it's not one of the main arguments for this push for HTTPS.

Of course, you're right. My phrasing was not the best. The rogue CA would need to perform a classical MiTM as all the other mortals do, having access to the signing keys does not g…

This is important. Because the discussion around HTTPS tends to train users into think that HTTPS = Web Security. I totally agree that it's important, and I understand the attack v…

You don't need to have private keys to exploit this scenario. Let's say you own example.com, and you add a certificate by Let's Encrypt. If Let's Encrypt is a malicious actor, they…

If it's an NSA honeypot it will still be a positive thing for 99% of use cases. Also, why would they do this? It's smarter to compromise the existing CAs.

I see what you mean. And this is the problems with this subject and why most of the times these discussions end up nowhere. We end up discussing on what this hypothetical "regular …

Of course, but I think that your portrayal of the regular user is not of a regular user at all. The regular users I know don't even know what syncing is, what the cloud is, what in…

Totally agree with your familiarity argument. I think that's the main reason why Linux can't compete. One can think that the desktop OS for a regular user is a commodity, so why re…

I think that your view on the needs of the regular user is pretty agreeable. I don't get why you got these kind of replies. Nothing you said was controversial about the regular use…

A quick line count shows that the file from your link has 14354 entries, while the one on the github repo has 65357.

A good solution I've found for ad blocking is using the following hosts file: https://github.com/StevenBlack/hosts Which sinkholes every known ad/malicious domain. It's been pretty…