adam, to foss

I was influenced by many privacy advocates in the 90s, but one in particular (who I won't name, because privacy).

They were raising awareness about #Carnivore, #ECHELON, and #Cryptography (PGP is particular).

Unbeknownst to me at the time, this started my journey into civil rights and technical tools to defend them.

I bumped into the @eff along the way.

Now I make open source hardware cryptographicly secure password managers, among other things.

#JoinArtisansCoop @coopartisans #FOSS #crypto

cendyne, to random
@cendyne@furry.engineer avatar

Why are bots posting my blog with... ChatGPT generated (and factually incorrect) summaries?? For no one to see too (4 views)

@soatok has some of this as well.

#cryptography

rollbrettklauen, to Blog German

Hey, everyone 🫶

Was reading a few blog posts today and was wondering, if anyone is interested to share their favourite #blog or #article

My favs are:

https://blog.orhun.dev by @orhun, mostly about #Linux, #Rust and a cool series called #Zig Bits

https://words.filippo.io by @filippo, about everything #cryptography and a bit of #Golang

I like reading about #serenityos from time to time on https://awesomekling.github.io

What are yours? :)

(Boost for exposure? :blobcatheartbongo:)

ricardoharvin, to random
@ricardoharvin@mstdn.social avatar

"If we miss something as big as Elizabeth, who is crucial in two world wars...who fights the , if we missed her, who else are we missing?"

, a previously buried (in part by J. Edgar Hoover) inventor of .

https://youtu.be/JiQz58Y67To

pluralistic, to Signal
@pluralistic@mamot.fr avatar

They’re still trying to ban

https://doctorow.medium.com/theyre-still-trying-to-ban-cryptography-33aa668dc602

Call this the “enforcement nexus” — for a government to enforce a law, it needs something to seize. Governments have broad latitude to seize things and people within their territorial borders (though this is not absolute, as I’ll discuss below). But when it comes to conduct outside a government’s territory, enforcement depends upon the cooperation of another government — this is why so many crime dramas turn on a desperate dash for countries that don’t have extradition treaties. Governments can project enforcement power into any territory that will allow it to seize the people or property of its adversaries. When the Argentinian government defaulted on its bonds, it failed to reckon with the fact that its US dollar holdings were stashed in the US Federal Reserve Bank in New York. That meant that the vulture capitalists seeking to squeeze Argentina could argue their case in their home court in the USA, seeking a judgment that could be enforced domestically — that is, by seizing the Argentinian government’s assets held on US soil.
National firewalls are everywhere today. Sometimes, they’re sold as turnkey solutions — by both Chinese and western firms — to poor countries with very little technical capacity of their own. Spy agencies from large, powerful countries love it when poor countries install foreign-made national firewalls, as these are key to “third-party collection” (when a spy agency taps into another spy agency’s files) and “fourth-party collection” (when a spy agency taps into another spy agency that has tapped into another spy-agency’s files). As national firewalls proliferate, so too do enforcement nexuses. After Edward Snowden revealed that US tech giants were allowing US spy agencies to plunder their user data, the EU imposed a (perfectly reasonable) data localization regulation that required US tech companies to keep Europeans’ data on servers within the EU (this regulation remains contentious and fragile). The EU doesn’t have a regional or national firewall, so tech giants who don’t want to comply with the regulation could simply withdraw their sales offices and engineering departments and lobbyists from the EU and ignore the rule — at least to the extent that they could convince US courts not to enforce EU judgments against them. But the EU has other enforcement nexuses it could rely upon. It could order European banks and payment processors to block payments to tech firms that ignore the localization rule. Payment processing remains a
Enter American culture-war nonsense. In Texas, they want to ban websites that explain how to get an abortion, as well as sites that ship the pills for a medication abortion. In Florida, they want to force bloggers who write about the state government to pay a fee and register with the state, prohibiting anonymous commentary about the state legislature and its actions. Florida has also required that online providers cease permitting their users to display pronouns other than the ones they were assigned at birth. Of course, online services have no way to know what pronouns any of their users were assigned at birth, so sites like Github are complying with Florida law by simply not displaying pronouns to Floridian users. The biggest barrier to enforcing these laws is the US Constitution, which these laws assuredly violate. It’s entirely possible that a lower court will uphold these laws. It’s conceivable that an appeals court will do so as well. It’s not outside the realm of possibility that the current Supreme Court — illegitimately stacked with far-right partisan hacks lacking any shred of principle — will follow suit. But it’s far from a sure thing. It’s not even clear whether the legislatures that passed these laws and the governors who signed them want them to be enforced. After all, if these policies do come into force, large numbers of corporations are likely to shutter their offices and move out of state (especially in Florida, an increas

zerotier, to random

On Wednesday, 26 July 2023, at 12 PM ET/9 AM PT/6 PM CEST Team ZeroTier will host a webinar for our user community featuring our Founder & CEO, @adamierymenko.

During this one-hour session, Adam will discuss the ZeroTier mission, networking industry meta trends, and the exciting things on tap for ZeroTier.

We look forward to having you join us!

https://us06web.zoom.us/webinar/register/3116896224200/WN_BfuzUgpfTxSsb3BsK1Dcnw

#ZeroTier #networking #cryptography #ModernVirtualNetworking #webinar

atoponce, to random
@atoponce@fosstodon.org avatar

Just a quick note about why quantum computing primarily attacks asymmetric algorithms and not symmetric ones.

Asymmetric keys are generally built on trapdoor functions—functions that are trivial to calculate, but difficult to reverse. Such as multiplication and division.

Asymmetric keys have structure in the group that symmetric keys don't have, and it's quantum computing algorithms that exploit this.

#cryptography

1/n

rasheedahmed, to opensource

@skiff open sourced their cryptographic library "including useful functions for symmetric encryption, asymmetric encryption, hashing, and more. Contributions and suggestions are welcome!"

#OpenSource #foss #npm #nodejs #e2ee #encryption #cryptography #ellipticcurvecryptography #ecc #emailencryption

aspiringcat, to security

I’ve been making a lot of not-getting-cryptography jokes here lately but honestly the way my advisor explained a simplest secret sharing representation blew my mind. Why did I not know this before??

Your secret function is a line y=mx+c and your secret is value of y at x=0. Each party has one point from the line. Individually, with just one point there can be numerous lines passing through that point but only when they come together, they can compute the secret.

#security #cryptography

filipw, to security
@filipw@mathstodon.xyz avatar

this is a fantastic result but also... quite worrying

"This paper presents a practical implementation of a state-of-the-art deep learning model in order to classify laptop keystrokes, using a smartphone integrated microphone. When trained on keystrokes recorded by a nearby phone, the classifier achieved an accuracy of 95%, the highest accuracy seen without the use of a language model. When trained on keystrokes recorded using the video-conferencing software Zoom, an accuracy of 93% was achieved"

📝 A Practical Deep Learning-Based Acoustic Side Channel Attack on Keyboards
🔗 https://arxiv.org/abs/2308.01074
🏷️ #cryptography #security #infosec

atoponce, to random
@atoponce@fosstodon.org avatar

I just learned that will automatically and correctly clamp any private 32-byte key.

For example:

$ openssl rand -base64 32
tx6Kwv9L17ARq8WOd0M3sjm8gKU8bmdoSeBoGTzyEyY=

Even though the first and last bytes are not properly clamped above, when generating the public key, the wg(8) tool will clamp it. Further, when bringing up the interface, Wireguard will also clamp it.

See https://git.zx2c4.com/wireguard-tools/tree/src/genkey.c and https://git.zx2c4.com/wireguard-linux/tree/drivers/net/wireguard/noise.c (search for "curve25519_clamp_secret")

sarahjamielewis, to privacy
@sarahjamielewis@mastodon.social avatar

Hello Everyone! I'm Sarah. Executive Director of Open Privacy (https://openprivacy.ca/) - a Canadian non-profit society dedicated to researching & building privacy enhancing tools (like https://cwtch.im) that empower people.

I spend most of my days conducting #cryptography and #privacy research, and a fair amount of time disclosing security issues in a variety of systems.

#introduction

nausiyan, to opensource

Cannon has a proprietary way of signing photos to make it proof that the file has not been tampered after taking photo. I am wondering if there is an #OpenSource way to do this on like an android phone. Take a photo and have it be cryptographically guaranteed against phone hardware that it has not been tampered with after taking the photo. #cryptography #photography #signatures #foss #android #legal #legaltech

scandrof, to random

"In a suburban Brisbane garage, young women decoded radio transmissions that changed the course of World War II. For the first time, their top-secret work on a panicked Japanese cable about a new type of weapon can be revealed."

The Garage Girls and the secret war machine which uncovered Japanese secrets - ABC News https://www.abc.net.au/news/2023-06-03/garage-girls-world-war-2-spying-in-australia/102411022

emi, to random

The Ultimate Answer to Life, The Universe and Everything is...

-----BEGIN PGP MESSAGE-----

jA0ECQMId9Vh7lnTMVX10sCSATuF5pBvqwfpabhTTNo1rsuttG3ZgBSOFF8ZdaRJ
xkHYCxSWi/5HBlNudQaLiYZee6feXtT+5soz/KUzJMDRfRmrjBGkZ5V3IY6/sY4U
OiSHIbghPCifP3HALRAxoO1qDDrD8lvVwj9NlEPidTmGDIPRjRC0dR/z3RYvSXWY
Lbgcm53Xbxro1CHZBuSsNXtUP4OvzcUYMjKxOM6/avg8JhbwgNbWhqOiCZy+Sme2
m6UjD/TJ++c9niKheORIiDAXXN+bh1GV9n7siNDKN22IVTpBm9BV4Wy2FbhjAfSi
/meW7FVbRV8s072PDmh1kh8QckNdN4FK2hyIefBO560yRH7xyi5P+Ph/4S3JBebE
ZTdXYAo9KJef/9bFak5EOQ5sVzvbd6WzmCc5vju9RQfnPruHF9Qk2zO5Su1lrf6K
CakD6H5M1prfDaDzMFsjJPSZFTg=
=nTGR
-----END PGP MESSAGE----- #pgp #cryptography

cendyne, to random
@cendyne@furry.engineer avatar

Safari 17 is coming with support for Ed25519! #cryptography

cendyne, to random
@cendyne@furry.engineer avatar

NIST to withdraw 800-67 R2

In other words, yeet :blobfoxyeet: 3DES for further encryption.

Decryption, key unwrapping, and verification of existing MACs to remain.

#cryptography
https://content.govdelivery.com/accounts/USNIST/bulletins/362a68f

kenji, to random German
@kenji@chaos.social avatar

Heute ging es an der TH Köln um das chinesische Spionage- und Cyberrecht - bei vollem Haus mit 170 angemeldeten Teilnehmer:innen! Wer nicht dabei sein konnte: Der Vortrag wurde aufgezeichnet, in Kürze gibt es hier den Link. #china #cyberlaw #cybersecurity #cryptography

raptor, to random

Insightful…

Web-based #cryptography is always snake oil 🐍

https://www.devever.net/~hl/webcrypto

pyperkub, to infosec
@pyperkub@mastodon.social avatar

Finished @pluralistic 's Red Team Blues over the weekend and loved it. Can't stop recommending it #cryptography #RedTeamBlues #InfoSec #ScienceFiction Here's a cryptographer's review - https://blog.cryptographyengineering.com/2023/04/24/book-review-red-team-blues/

codeawayhaley, to EliteDangerous
mjgardner, to infosec
@mjgardner@social.sdf.org avatar

@Perl Good news, the #Perl module IO::Socket::SSL now defaults to using the #TLS cryptographic protocol version 1.2 or greater. (Earlier versions have been widely deprecated for a couple of years due to weaknesses found in the #MD5 and #SHA1 hashing functions.)

Note that if you’ve updated #OpenSSL recently you may also have to rebuild and reinstall Net::SSLeay from #CPAN.

#infosec #security #cryptography #SSL https://g0v.social/@gugod/110392435778885615

cuchaz, to random
@cuchaz@gladtech.social avatar

Howdy #cryptography friends,

Let's say I have 1000 friends (haha, I know, right?) and I want to send each of them a number. If I put all the numbers into a list and send the list to all my friends, that sort of works, but each friend won't know which number is theirs.

So I'd like some way to tag each number in the list so each friend can quickly tell which number is theirs, but no one else can. ie, something faster than linear time search through the list would be ideal, but I'd settle for something linear if the constants are small. Maybe something like string equality as the match operation, but not a decryption.

And if someone who isn't my friend sees the list with all the tagged numbers, they shouldn't be able to tell who any of my friends are by using the tags somehow.

Me and all my 1000 friends (lol, it's still funny) all have asymmetric keypairs, so we can use those.

Is this a well-studied problem that has a name I don't know about yet? Maybe there are special-purpose tools that are a good fit for this?

Or maybe there's some clever scheme using encryption that solves this? I feel like a deterministic encryption of some well-known message for each friend gets pretty close. Then add a list-level nonce to make it randomized for each list, but not each friend. Then a friend can do the deterministic encryption using the nonce and scan through the list pretty quickly to find their number. But my asymmetric encryption primitive is randomized, so I can't quite make it work that way unless I use a different primitive.

Although, if the message to be encrypted deterministically is well-known, and the goal is not actually to protect the message, that kind of suggests encryption is the wrong tool here. I'm looking for some kind of tag that is only recognizable by the holder of the private key.

Thoughts?

simplenomad, to Wyze
@simplenomad@rigor-mortis.nmrc.org avatar

Question for crypto (as in cryptographic) nerds, I am looking for an automated solution for on-prem backups that encrypts said backup. The plan is to take said encrypted backup and store it off sight. Prefer open source, and for further context consider this "home lab" although it does involve multiple servers with public IPs etc. I do not want to have the encryption key easily reachable like in plaintext in a config file.

Right now this is all happening manually, but automated would make this so much easier. It does not have to be a full end-to-end solution, even just the encrypting part being able to be automated would be fine as I could simply script around it. Thoughts and recommendations?

#cryptography #backup #automation #infosec #security

  • All
  • Subscribed
  • Moderated
  • Favorites
  • JUstTest
  • mdbf
  • ngwrru68w68
  • modclub
  • magazineikmin
  • thenastyranch
  • rosin
  • khanakhh
  • InstantRegret
  • Youngstown
  • slotface
  • Durango
  • kavyap
  • DreamBathrooms
  • megavids
  • GTA5RPClips
  • tacticalgear
  • normalnudes
  • tester
  • osvaldo12
  • everett
  • cubers
  • ethstaker
  • anitta
  • provamag3
  • Leos
  • cisconetworking
  • lostlight
  • All magazines