Why do you think SSH-Keys are safe against phishing? I mean it is unlikely, that someone will just send the key per mail or upload it somewhere since most ppl using SSH-Keys are more knowledgeable.
When you now get an easy one click solution to transfer Passkeys from one Cloud provider to another it will get easier to trick a user to do that. Scenario: You get a mail from Microsoft that there is a thread and that you need to transfer your keys to their cloud.
They moved to wayland 2 years ago. https://tails.net/news/test_5.8-beta1/#index2h1
Not exactly. They are pointing out that HTTPS assumes all is well if it sees a certificate from any “trusted” certificate authority. Browsers typically trust dozens of CAs (nearly 80 for Firefox) from jurisdictions all over the world. Anyone with sufficient access to any of them can forge a certificate.
Great thing, that you can remove them and only trust those you trust.
Also, HTTPS doesn’t cover all traffic like a properly configured VPN does.
Pls explain what https is not covered? The SNI on tbe first visit? A VPN just moves the “exit point” of your traffic. Now the Datacentef and VPN provider sees what you ISP saw.
it’s not difficult for a well positioned snooper (like an internet provider that has to answer to government) to follow your traffic on the net and deduce what you’re doing.
No. I never said otherwise. But they cannot spy on the traffic. And since the SNI is not encrypted anyway they do not even nerd to “follow the traffic”. But what sites you are visiting and what you are doing on them are 2 different things.
You can read more about this learning about X.509.
Its the PKI thats broken, namely the root stores. Has been unreliable for many, many years. This is why packages are signed.
So you are basically saying that root CAs are unreliable or compromised?
The great thing is, that you can decide on your own which CAs you trust. Also please proof that those are actively malicious.
And no. That is not the reason that packages are signed, i am guessing you mean packages like on linux, packages contained in the installation repository. The reason is, that you build another chain of trust. Why would i trust a CA which issues certificates for domains with code distribution. That’s not their job.
I mean the “Crypto AG” was a thing. So not that unrealistic.
But that Proton is CIA is not that realistic imho but not impossible.
Yes it has better defenses against timing attacks. Just alone the fact that multiple packets are bundled together makes it harder to identify the route a single package used.
Also, it seems that I2P is more vulnerable against deanonymization when leaving the hidden network, i think the official I2P faq has some info about that, but have not read up upon it myself.
Not only huge files. At the end of the article the author goes on about changing the load or manipulating the timing of the traffic.
For both you need to be part of the network and (to some degree) the traffic you want to trace needs to go through a node you are controlling if i understand it correctly. With increasing size it becomes more difficult.
Nope, I2P is still vulnerable to timing attacks. https://en.m.wikipedia.org/wiki/Garlic_routing
Not much information on the data. But still some critique of the data:
“use ad blocking tools at least sometimes” so not all the time
Both of those metrics exclude lots of data for example, when you scroll down you see that yes a lot of ppl use ad blocker on the PC but not on phones or tablets. Also ppl below 16 have a very low usage rate also ppl above 64.
I think actually ad block usage by sites visited with and without ad blockers would be nice too.
But thank you for the link, guess ad blockers are indeed more popular than i thought.
That was a rhetorical question towards the commenter since the discussion point was not understood.