71–80 of 140 posts
That way, a DH compromise merely lose forward secrecy and the data would still be safe as long as the server private keys are not compromised.
Earlier quoted context omitted.
People expose and oppose the government everyday in various forms. You would expect the news to be filled with scandals of government opposers or we would have no opposition at all in the US due to them being blackmailed etc. Neither is true.
And? They ought to be exposed and opposed. They serve at our pleasure, not the other way around.
No it actually doesn't and shouldn't. It would create a tyranny of the majority.
Earlier quoted context omitted.
And? They ought to be exposed and opposed. They serve at our pleasure, not the other way around.
> they serve at our pleasure No it actually doesn't and shouldn't. It would create a tyranny of the majority.
Tor browser 5.0.3/latest(based on firefox 38.0.3) is not listed. However, it does have .dhe enabled/"true" set in the config file. For those of you running - it might be good to add this to your disable "to-do" list.
I'm not saying people shouldn't do it. But just be aware of the trade-off.
Earlier quoted context omitted.
Easy-rsa[1] (OpenVPN's key/cert generation/signing tool) version 3 will generate a 2048 bit diffie hellman key by default. Previous versions of easy-rsa used 1024 bit as default. Here is a comment written in the vars configuration file for easy-rsa 2.2.2: # Increase this to 2048 if you # are paranoid. This will slow # down TLS negotiation performance # as well as the one-time DH parms # generation process. export KEY…
From what we know as long as it is a custom 1024-bit DH key and you're not being actively targeted by the NSA you are probably okay. That said, you should still upgrade to 2048-bit (or higher, if you're paranoid) ASAP.
Earlier quoted context omitted.
One of the main things I want to keep private is just family life - conflicts, love, sex, etc. I don't want the government to know about my private family life. I don't see how a free, thoughtful, creative society can flourish if the government can always know the goods on everybody.
I don't think the government wants to know about your private family life neither. I mean, it's edgy to imagine that the government has a secret file on all of us. But they don't do they? It's just very silly nonsense.
Earlier quoted context omitted.
FWIU of the situation, we have reason to suspect the government has 'cracked' the default large primes that are commonly used by a bunch of different software packages, including web servers. Assuming they have, the challenge is then defined as determining which applications and sites tend to use these standardized or hard-coded primes. > Breaking a second 1024-bit prime would allow passive eavesdropping on connectio…
"FWIU of the situation, we have reason to suspect the government has 'cracked' the default large primes that are commonly used by a bunch of different software packages, including web servers." This is just nonsense. Am I the only sane one here? Can no-one else see that the response is hysterical? There's no evidence whatsover that any of this has happened. It's conspiracy conjecture. Look, I know the cultural narrat…
This is an asinine pair of questions to ask because they are logically unanswerable and interdependently blaming. If someone were to answer "yes, you are the only sane person here", then you've successfully elevated yourself to a level by which you can judge. If someone were to answer "no, you aren't the only sane person here" you get the sequential treatment applied to the rhetorical question "So you can see this response is (then) hysterical?" and you still get to judge.
Clearly you think I'm hysterical, regardless of whether it was asked as a question or not.
I have every right to voice my opinions and questions about how we can trust the tools we use for our craft on a day-to-day basis. I also have the right to the expectation the tools aren't being mass-monitored by our government as a cheap and insecure way of doing their job: law enforcement. I am grateful to be fortunate enough to understand how we technically implement these levels of trust in our tools and feel it is part of my social responsibility to share my views on these matters with my peers. I don't believe in allowing criminals to break laws, but I also feel that making things less secure by trying to monitor everyone for criminal activity is not the answer because I also think it's prohibitively expensive to eliminate all criminal activity. Maybe that makes me hysterical...but at least I don't speak for others.
I made ZERO blaming statements in my comment. I asserted that, from what I understand of the parent article, we have reason to suspect the government has cracked, or has the ability to crack, large primes. We know for a fact that a lot of software uses the default primes, so the logic goes that the government has the ability to monitor a portion of what we would normally consider secure SSL traffic. That individuals have little way of mitigating this "venerability" is an important one here because it may depend on us working together to determine the attack coverage and exposure. Without knowing those things, we're really at a loss to what could possibly going on with monitoring.
I will also point out that, if those cracked prime solutions exist, they will eventually fall into the wrong hands.
Sadly, users who follow this advice will forget that they did by the time they can't figure out why connections fail to servers that have been configured for forward secrecy only but run an ECC-incapable version of Apache (thanks to long-term support Linux distros keeping old Apache around).