211–220 of 261 posts
Earlier quoted context omitted.
That's nice and all, and I don't doubt it, but in this instance, that cultural memory is (ironically) leading Germans to use inferior cryptography, and isn't serving them well.
Care to substantiate? What inferior encryption are you talking about?
Earlier quoted context omitted.
Hm. So you think that libsodium is going to dry up and disappear from the internet in "5 years' time"? Bear in mind that its first GitHub import was in 2013 and that it is used, and supported, by lil' guys like...uh...lemme look at this..."Google". While it's drying up and disappearing, is it going to take with it things like rbnacl which both use it transitively, package it for their environments, and also have some…
Google is not necessarily forever
Earlier quoted context omitted.
Attacks on free speech in USA and Europe have nothing to do with offensive language and everything to do with control. Be careful what precedents you set and what things you celebrate. Pendulums swing. Are you referring to this? I don't think anybody tried to censor her for this, even though it was incredibly offensive. https://talkingpointsmemo.com/news/tlaib-going-to-impeach-mo...
And here we go with the currently popular victim game which also brings the famous "censorship vs. moderation" trope and the "das wird man doch wohl noch sagen dürfen" classic. Please...this is ridiculous. Nobody falls for that besides the right wingers themselves. Nobody wants the right circle jerk in their comment section. The same way the right doesn't want any criticism of their behavior within their own bubble p…
It is hard to make example that would not further polarize this thread, but I can promise you that the same intolerance and bubbles are present on both side of the political spectrum (for sure in the US, even if I live in Germany now I don't know much about this country...)
Earlier quoted context omitted.
Care to substantiate? What inferior encryption are you talking about?
Presumably old encryption/sign constructs used by pgp/gpg coupled with issues with serialization/de-serialization of data/cipher text?
I agree that the illusion of security has drawbacks, but so does using too many tools that you don't properly understand.
Earlier quoted context omitted.
No, it's not "badly flawed". Your files won't be compromised. GnuPG could do with better defaults, but that is true for every system good enough to have aged. A more modern KDF would also be welcome but it won't impact end user security. Just to put things in perspective.
> Your files won't be compromised. ...if you use it correctly. It appears that many people can't do this.
Telling users that it's broken without pointing to a clear alternative is counter productive as they are likely to end up much worse.
A more modern KDF would be welcome, but it is also important to communicate the benefit to an end user: You get comparable security with a shorter password. There are other things to consider when choosing an encrypted file format.
Earlier quoted context omitted.
Also magic-wormhole relies on a hardcoded intermediary servers for which author gives no guarantees.
You can simply run your own. The protocol doesn't rely on the servers for security.
Earlier quoted context omitted.
Also magic-wormhole relies on a hardcoded intermediary servers for which author gives no guarantees.
Its not hardcoded, its just the default server. You can specify your own via a cli flag.
Earlier quoted context omitted.
Maybe to ensure that it was you that created the backup? It may be nice when restoring the backup.
But if you encrypted them, there is no reason to also sign them. Either you have the key to decrypt, thus you did it, or you don't, so you didn't. Signing is for verification of identity over potentially compromisable channels. Not securing controlled items.
Earlier quoted context omitted.
This. If you share a temporary password through another secure channel, you can probably just share a symmetric key and then you don't need PAKE anymore. In some cases though, you might want to send yourself something from one device to the other, or you are talking to someone who's not really technical on the phone. About being online at the same time, I was under the impression that this wasn't a requirememt.
(author of magic-wormhole here) To transfer a file, both parties do need to be online at the same time. The server (which I run) does not store the file's data: it stores tiny key-exchange messages until both sides manage to make a direct connection, but then the encrypted file data is sent from sender to recipient without being stored in the middle. So it doesn't replace email or an FTP server or some other asynchro…
Earlier quoted context omitted.
This. If you share a temporary password through another secure channel, you can probably just share a symmetric key and then you don't need PAKE anymore. In some cases though, you might want to send yourself something from one device to the other, or you are talking to someone who's not really technical on the phone. About being online at the same time, I was under the impression that this wasn't a requirememt.
(author of magic-wormhole here) To transfer a file, both parties do need to be online at the same time. The server (which I run) does not store the file's data: it stores tiny key-exchange messages until both sides manage to make a direct connection, but then the encrypted file data is sent from sender to recipient without being stored in the middle. So it doesn't replace email or an FTP server or some other asynchro…