Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Snowden Meets the IETF

mnot.net

Post reply on HN
Print view View original

71–80 of 80 posts

Re: Snowden Meets the IETF

#71

Post by davidgerard »

undefined0 wrote: post #51
davidgerard wrote: post #45

Earlier quoted context omitted.

What we see in practice with all extant implementations of blockchains is increasing centralisation. Because computing hashes is the sort of computation whose efficiency per watt greatly increases with more and more specialised hardware. Thus the Bitcoin situation, where the promise of everyone being able to mine a few coins has become a small number of Chinese mining pools; altcoins do no better.

> altcoins do no better. Most altcoins are Proof of Stake, where mining via computing hashes doesn't take place. "Blockchains" isn't limited to Proof of Work, you can even get non-PoS/PoW blockchains such as Hyperledger.

I thought "most" altcoins were simple Bitcoin or Litecoin clones with changed parameters. What sort of numbers are you estimating "most" from?

Re: Snowden Meets the IETF

#72

Post by popee »

pjc50 wrote: post #8
s_q_b wrote: post #5

Earlier quoted context omitted.

I refuse to believe we cannot have both.

Security must, by its very nature, prevent you from doing insecure things. This manifests as an obstacle to users, so they end up choosing the insecure route (writing down passwords etc etc). Decentralised systems tend to lose to centralised ones because there's no money locus for advertising, development or curation. It's not totally doomed; the popularity of Snapchat suggests there is demand for services that don't…

> Decentralised systems tend to lose to centralised ones because there's no money locus for advertising, development or curation.

Yeah, e-mail systems lost :-) Anyway, corporate monopols are problem, not systems.

Re: Snowden Meets the IETF

#73

Post by lewisl9029 »

e12e wrote: post #42
Zigurd wrote: post #12

Earlier quoted context omitted.

When Skype was secure, was it usable?

Secure how? It's always been opaque and subject to the whims of a central compaby and a centralized architecture?

It was decentralized at one point, before this happened:

https://news.ycombinator.com/item?id=3915479

Re: Snowden Meets the IETF

#74

Post by mirimir »

enraged_camel wrote: post #35
JoshTriplett wrote: post #20

Earlier quoted context omitted.

That's necessary, but not sufficient. We need both sane policies and technical measures to ensure that nothing less than those policies is possible. If we only have the technology, policy-makers can and will make life difficult both for the users and makers of these technologies; more draconian regimes will simply never allow those technologies to take root to begin with.

Either that, or they will simply intimidate and even torture people for their private keys. May sound far-fetched, but it isn't.

Far-fetched?

Not in the UK, for example.

> The Regulation of Investigatory Powers Act 2000 (RIPA), Part III, activated by ministerial order in October 2007,[20] requires persons to supply decrypted information and/or keys to government representatives with a court order. Failure to disclose carries a maximum penalty of two years in jail. The provision was first used against animal rights activists in November 2007,[21] and at least three people have been prosecuted and convicted for refusing to surrender their encryption keys,[22] one of whom was sentenced to 13 months' imprisonment.

https://en.wikipedia.org/wiki/Key_disclosure_law#United_King...

Re: Snowden Meets the IETF

#75

Post by jedisct1 »

Panino wrote: post #33
tedunangst wrote: post #19

Earlier quoted context omitted.

> I'm glad Snowden said DNS should be encrypted. And yet, when HBO screwed up their dnssec config and Comcast blocked the site, how did users react? By demanding Comcast stop verifying! (Fully encrypted DNS can only fail in even more ways than dnssec.)

> (Fully encrypted DNS can only fail in even more ways than dnssec.) The main reasons DNSSEC fails frequently are: * pre-computed signatures, rather than online signing * a demented, overly complex protocol * signatures that expire rapidly Maybe tptacek can name some others. The only DNS encryption people are currently using (DNSCurve/DNSCrypt) does per-packet encryption, with a very simple protocol involving only a…

DNSCurve and DNSCrypt use authenticated encryption.

DNSCrypt is not stuck to "a single ciphersuite designed by djb". The ciphersuite is negotiated (using DNS queries + signed responses in DNSCrypt v2, and TLS in DNSCrypt v3).

Over TCP, it's not limited to "per-packet encryption" either.

Re: Snowden Meets the IETF

#76

Post by jedisct1 »

arca_vorago wrote: post #36
Panino wrote: post #2

It must have been an exciting surprise for attendees. I'm glad Snowden said DNS should be encrypted. From the tweet stream provided by @conflictmedia, that was tied for 1st for most re-tweeted, along with making the Internet for users, not spies. (It should be noted that DNSSEC is not encrypted.) Too bad his appearance wasn't recorded, but HUGE thanks to Niels ten Oever and Rich Salz for tweeting major points!

This is where I get to plug djbdns and DNSCURVE over DNSSEC. I think DJ has been ahead of the curve (no pun intended) on these things for quite some time. I am currently in the process of migrating from bind9 (and avoiding bind10 like the plague) to djbdns wherever possible. Quirks and lack of updates/extensions not withstanding, it's great so far. http://dnscurve.org/integration.html

A major issue with DNSCurve (and, to some extent, DNSSEC) is that you can't really do validation on the client.

Routers frequently redirect anything going to port 53 to a local cache and anything that doesn't look like regular, unencrypted DNS queries, will be dropped on the floor.

It's also fairly common to have routers only support some DNS records, or to be unable to return more than one record type in a response (e.g. no RRSIG records and A records together). Wi-fi access points are particularly good at making any attempt at making DNS more secure next to impossible.

I've been working on DNSSIG, a DNSCurve-like protocol that encapsulates signed responses in TXT and CNAME records, similar to what ip-over-DNS tunnels do. The end result is pretty ugly.

DNSCrypt initially used port 53, similar to DNSCurve, but it turned out to be a terrible idea, as it didn't work for the majority of home users, that had routers redirecting DNS queries.

Re: Snowden Meets the IETF

#77

Post by cperciva »

makmanalp wrote: post #27
JoshTriplett wrote: post #20

Earlier quoted context omitted.

That's necessary, but not sufficient. We need both sane policies and technical measures to ensure that nothing less than those policies is possible. If we only have the technology, policy-makers can and will make life difficult both for the users and makers of these technologies; more draconian regimes will simply never allow those technologies to take root to begin with.

I think this needs to be expressed more often. Not only will draconian regimes now allow it, but it's also harder to protect such systems at the ends. I saw a presentation by cperciva at some point that talked about the "Three B's": Bribery, Burglary and Blackmail. So tech should be one of many tools to combat oppressive societal structure - some other ones being more social and legal tools.

The concept of the "three Bs" has been around for longer than I have. In my talk ("everything you need to know about cryptography in one hour") I added a fourth B, "guantanamo Bay", aka. torture.

Re: Snowden Meets the IETF

#78

Post by simoncion »

pjc50 wrote: post #70
simoncion wrote: post #55

Earlier quoted context omitted.

Oh! You were looking for audited sync clients. Yeah, I've got nothing there. Edit: I would ask "How hard could it be to solve 90% of the problem?", but various BigCos have had spectacular failures in recent memory, so I guess the problem is pretty damn hard. I wonder how terrible using git as the backbone for one's sync software would be.

There's git-annex for that. I've not tried it myself.

I had heard about git-annex before, but never had looked into it. This sounds pretty neat! I wonder what its horrifying data-eating failure modes are! :D

Re: Snowden Meets the IETF

#80

Post by hueving »

cperciva wrote: post #77
makmanalp wrote: post #27

Earlier quoted context omitted.

I think this needs to be expressed more often. Not only will draconian regimes now allow it, but it's also harder to protect such systems at the ends. I saw a presentation by cperciva at some point that talked about the "Three B's": Bribery, Burglary and Blackmail. So tech should be one of many tools to combat oppressive societal structure - some other ones being more social and legal tools.

The concept of the "three Bs" has been around for longer than I have. In my talk ("everything you need to know about cryptography in one hour") I added a fourth B, "guantanamo Bay", aka. torture.

guantanamo bay is pretty lame in comparison to what other oppressive regimes will do.

I would suggest changing it to something more direct like "Breaking kneecaps" or something along those lines.

Post reply on HN