• 0 Posts
  • 110 Comments
Joined 2Y ago
cake
Cake day: Jun 09, 2023

help-circle
rss

Not necessarily traffic. Often download sites use mirrors to serve you the download. Sometimes those links are provided via a CDN which can be forced to comply to LEA or some other static hosted mirrors which are often hosted by others. The second part is more likely on community managed software.

So either traffic or the server/CDN behind the link. Happened before.


Was not aware ECH was actually in TLS 1.3 thanks for that. But yes it will take a long time for widespread adoption.


Actually no. The SNI is still not encrypted. So every site you are visiting can still be sniffed.


I encountered it now multiple times that new TLD are discriminated against. They are more likely to get blocked. This applies not only to Mails also to any more controlled network like free wifi networks or business networks.

Go with a classic .com .net .org or a country TLD if you can.

Btw, also applies to registrations on online services.


So I’d like to split my passwords file into multiple “files”, where the unimportant logins are permanently unlocked for convenience, while the more sensitive login credentials remain encrypted until I actually need them.

And how should that protect you against an attack that has compromised your system? If the system is compromised, then an additional lock does not hinder the attacker to wait until you open it.


The tweet he commented on was indeed a nice idea, but a CEO should have more foresight that the things Trump stated in it would not be true. When you look at it now, it looks like it was more or less a threat that led to a closer relationship between “tech bros” and the current administration instead of the “take down” of them.


But other solutions work also. And all of those provide anonymity and are not a VPN. For example I2P, TOR and Seedboxes in other countries may even be paid anonymously.

Pirates use anonymity in order to avoid being detected, and those tools provide anonymity.


The benefits of the nowadays VPNs are mainly privacy and piracy related.

Piracy is actually not the reason to use a VPN, pirates use a VPN to be anonyme and not to pirate content.

Similar as you would not say a hammer is a tool that can be used to hit something and not a hammer is used by construction wormers and burglars.


The cheap models can not be flashed with openwrt since they use some proprietary drivers or something.

The complete Opal series is not supporte iirc.



And how often. have you said stuff that you have not received advertising for? You will notice it when you get a positive match but not on a negative.

Data collecting companies can predict/rate your behavior for more then 20 years based. Since then. it has been perfected. They know that you are interested in those topics without having the need to waste resources on recording and analyzing every single audio stream.


Extracting the key from a TPM is actually trivial but immense time consuming.

Basically this with probably more modern chips and therefore even smaller cells. https://youtu.be/lhbSD1Jba0Q

Also sniffing is a thing since the communication between CPU und TPM is not encrypted.


TPM is not only used by the system encryption. But no i do not use it for it. Not because of privacy, cause of security reasons.


That was a rhetorical question towards the commenter since the discussion point was not understood.


The thing is, that you only have to share public keys and never private ones. So you can only phish public keys…

How would you sync or transfer a passkey across devices without transferring the private key?


Why do you think SSH-Keys are safe against phishing? I mean it is unlikely, that someone will just send the key per mail or upload it somewhere since most ppl using SSH-Keys are more knowledgeable.

When you now get an easy one click solution to transfer Passkeys from one Cloud provider to another it will get easier to trick a user to do that. Scenario: You get a mail from Microsoft that there is a thread and that you need to transfer your keys to their cloud.


With the ability to transfer passkeys, the attack vector phishing does not sound that far fetched. Tho i have not looked into the transfer process.

We will see i guess.





  1. And? If you cannot trust then you should not use them when you want to do something that is private and should not get looked on.

  2. And if there were signs of misuse of the trust, then they would get removed.

It is actually really easy to monitor thanks to CT.


Yes, there is countless examples of root CAs containing compromised CAs.

This incidence with digicert is not about a compromised CA it is about a flaw in their validation system. That is not what you claimed. Such flaws happen from time to time, lets encrypt had an issue a while back too.


Not exactly. They are pointing out that HTTPS assumes all is well if it sees a certificate from any “trusted” certificate authority. Browsers typically trust dozens of CAs (nearly 80 for Firefox) from jurisdictions all over the world. Anyone with sufficient access to any of them can forge a certificate.

Great thing, that you can remove them and only trust those you trust.

Also, HTTPS doesn’t cover all traffic like a properly configured VPN does.

Pls explain what https is not covered? The SNI on tbe first visit? A VPN just moves the “exit point” of your traffic. Now the Datacentef and VPN provider sees what you ISP saw.

it’s not difficult for a well positioned snooper (like an internet provider that has to answer to government) to follow your traffic on the net and deduce what you’re doing.

No. I never said otherwise. But they cannot spy on the traffic. And since the SNI is not encrypted anyway they do not even nerd to “follow the traffic”. But what sites you are visiting and what you are doing on them are 2 different things.


Yes, there is countless examples of root CAs containing compromised CAs.

Then pls proof that? Link to a recent article maybe?


You can read more about this learning about X.509.

Its the PKI thats broken, namely the root stores. Has been unreliable for many, many years. This is why packages are signed.

So you are basically saying that root CAs are unreliable or compromised?

The great thing is, that you can decide on your own which CAs you trust. Also please proof that those are actively malicious.

And no. That is not the reason that packages are signed, i am guessing you mean packages like on linux, packages contained in the installation repository. The reason is, that you build another chain of trust. Why would i trust a CA which issues certificates for domains with code distribution. That’s not their job.


When you get judged based on what website you are visiting it is very likely that you are already the bad guy by using a vpn.


Yes. Not claimed otherwise. OC claimed that they see what you are doing which is wrong.


Basically everything online can be done encrypted. bittorrent has had support for encryption for years. There are other challenges like hiding from DPI and the thing that you broadcast your torrent IP but the content can be securely emcrypted.


They see what sites you are visiting yes but they do not see what you are doing on them. They do not see the content of the traffic. Huge difference.


a VPN provider can indeed tell what you’re doing

New to me that https is broken


Yes, any VPN provider will see what’s in your traffic, no way around that…ever…no matter who you choose

Yes, there is a way around it, just use https.


When you visit sites with https then the traffic is encrypted. They still see what sites you are visiting.


I mean the “Crypto AG” was a thing. So not that unrealistic.

https://www.washingtonpost.com/graphics/2020/world/national-security/cia-crypto-encryption-machines-espionage/

But that Proton is CIA is not that realistic imho but not impossible.


Yes it has better defenses against timing attacks. Just alone the fact that multiple packets are bundled together makes it harder to identify the route a single package used.

Also, it seems that I2P is more vulnerable against deanonymization when leaving the hidden network, i think the official I2P faq has some info about that, but have not read up upon it myself.


Not only huge files. At the end of the article the author goes on about changing the load or manipulating the timing of the traffic.

For both you need to be part of the network and (to some degree) the traffic you want to trace needs to go through a node you are controlling if i understand it correctly. With increasing size it becomes more difficult.


Garlic routing[1] is a variant of onion routing that encrypts multiple messages together to make it more difficult[2] for attackers to perform traffic analysis and to increase the speed of data transfer.[3]

First sentence. Check up the linked article as source.


Garlic routing[1] is a variant of onion routing that encrypts multiple messages together to make it more difficult[2] for attackers to perform traffic analysis and to increase the speed of data transfer.[3]

First sentence. Check up the linked article as source.


Yes, sorry i worded it incorrectly you can try to make it harder but timing attacks are still possible.

Nope, just a summary that this is just old news. There is nothing new in the article.