Posts by PapaPepe

Signalgate lessons learned: If creating a culture of security is the goal, America is screwed

Alas, cryptography is not simple

> Cryptography itself has to be simple to use or people won't use it.

This, I humbly propose, is exactly where we took a wrong turn. Long time ago; shortly after PGP appeared on the scene.

Little Jenny has nothing to hide. Prodding her to encrypt her e-mails only so that those of us who have good reasons to encrypt would not attract the attention of the Chief Magistrate was (a) not entirely ethical and (b) most certainly counterproductive.

A high-level military commander in any normal army does not protect his communications because it is simple to do so, he does it because if he does not, or of he fumbles doing it, he is taken in front of a pockmarked wall and offered his last cigarette.

If there was any way to ascertain the facts, I would offer a reasonable bet to any present that none in the clown troupe under examination could explain the difference between symmetrical and asymmetrical encryption, and outline the challenges of public key verification. If they did, they would not include new members to a communication cluster without performing (in this case not particularly well designed, but serviceable) public key verification by Signal "Safety Number" exchange via a personal telephone call... (Hello, may I speak to the editor-in-chief of The American East Ocean..?)

This, I believe, is the essence of the claim of fallacy in that quote.

Who is to blame?

Yours truly is at the very end of the queue of those that are motivated to defend the high-ranking members of the clown troupe currently occupying the White House and the neighbourhood. But I feel a quote might be in order:

"It is a frequently expressed view among computer security experts that cryptography must "just work", hidden from the user's view and requiring no special understanding or knowledge.

This is a fallacy: without a good understanding of the fundamentals, an end user will invariably make some seemingly trivial error that will, unknown to him, completely subvert the security of the system. Without knowledge of the fundamentals, it is difficult to differentiate between trivial and significant issues, or between minor and critical errors. Without an understanding of the functionality of the hardware devices and operating system components, and without a similar understanding of cryptography, participation in any activity that requires a high level of digital security is, at best, imprudent."

dead horse of magazine subscriptions

> ...The Atlantic, a periodical I used to enjoy before they paywalled themselves into,...

I hope this will not derail the discussion - but I can't resist because I share both the experience and the sentiment.

If my livelihood depended on my readers paying to read what I wrote, I would be highly motivated to put in place some cents-per-page payment mechanism, instead of hoping against all hope that flogging the magazine subscription horse will somehow resurrect it.

Build your own antisocial writing rig with DOS and a $2 USB key

Required reading

The article and comments are now on the required reading list for my grand kids.

Google makes end-to-end encrypted Gmail easy for all – even Outlook users

Google is already secure (but they don't know it ;)

There is no such thing as secure web-mail: no off-the-shelf browser provides any method by which an average user could confirm that script-crypto code sent to the browser at each login is not sending either the cleartext or the private key back to the service provider. However, web-mail system that are OpenPgP conformant (which this Google hogwash is not, but Proton - for instance - is) are of some use: they allow encrypted communication with users that do use OpenPgP encryption in PoP mode with client like Thunderbird on the end-point they are the only administrator of. Thus, with a modicum of care, the damage of breach is restricted to a single pair of communicators).

Incidentally, since Gmail allows creation of anonymous accounts (no CC number, no "recovery" email, no telephone number, no 2FA...), and since as of late it makes PoP/SMTP use mode less cumbersome than it was the case, it is - used with just a bit of knowledge and care - one of the most reliable services that provide e2e encrypted e-mail. Use their web-interface to administer the account only, and download/upload the messages using Thunderbird and OpenPgP. Distribute Captcha-like photographs with full fingerprint of your public key, keep Thunderbird profile and mail folder on encrypted removable media and calmly wait for the adversary to knock on your door with a rubber-hose. (Unless they prefer the "no-knock" MO in your particular jurisdiction).

Big browsers are about to throw a wrench in your ad-free paradise

O tempora! O mores!

> Brave has it's own problems: https://www.spacebar.news/stop-using-brave-browser/...

Link is to a long blog post which I abandoned after the following sentence:

"It's because he donated $1,000 in support of California's Proposition 8 in 2008, which was a proposed amendment to California's state constitution ..."

have we really reached a point where the main criterion for using or not using a piece of software is the political habitus of its developer?

The force is strong in Iceberg: Are the table format wars entering the final chapter?

Long time ago, there was a thing called "semantical data model". It was something owned by experts not in IT, but by the experts in the industry the application was meant to serve. Smart application architects did their utmost to have it documented and maintained. When data belonging to two different owners/organizations had to be merged, presence of documented an current semantical models for each source enabled a skilled programmed to build the merge mechanism in a day or two. Absence of semantical data model for either source ensured the merge was only an endless source of troubles.

Google fires 28 staff after sit-in protest against Israeli cloud deal ends in arrests

'antizionist, not antisemitic'

Please enlighten me.

I believe the creation of the state of Israel was an act of grave injustice towards the population of Palestine. It is also my observation that what that state is doing in Gaza today is genocide and not self-defence.

On the other hand, I do not have any ill-feelings towards Jews as an ethnicity, and I am perfectly aware that they themselves suffered immensely during the Third Reich.

If and when simplified political labels can not be avoided, this makes me "antizionist" but not "antisemitic".

(I will consider the ratio of up- vs down-votes as an indication of the correctness of the above-expressed view).

Hillary Clinton: 2024 will be 'ground zero' for AI election manipulation

The burden of proof

Why is it so difficult to understand: for democracy to function, the burden of proof that the election was free and fair lies with the winning side.

Dems are at it again, trying to break open black-box algorithms

Geese, ganders and hockey sticks

Should the same criteria that applies to software models that can determine the fate of one man be likewise applied to software models that can determine the fate of multitudes?

Just asking...

Raspberry Pi Pico cracks BitLocker in under a minute

Plastics?

One word: Truecrypt 7.1a

The only thing you must ensure is not that your adversary never gets physical access to your kit (very hard, with some adversaries impossible), but that she does not manage do so without leaving any trace. With just a bit of imagination, that is often surprisingly easy.

It took Taylor Swift deepfake nudes to focus Uncle Sam, Microsoft on AI safety

Nothing much to see here...

A pop entertainer rakes in millions selling her sex-appeal. Meanwhile, one of her lonely customers acts on his wet dream and shares a digital file with his compadres. I harbour no sympathy or antipathy for either, and I specifically see no particular reason for the Chief Magistrate to stick her nose into the case.

For those finding graphic artist's behavior disgusting, please consider the following beneficial consequence of the forthcoming deluge of such imagery and footage: simple and convincing deniability by the models featured in such material, whether real or fake. The ability of blackmailing the model is from now on inversely proportional to the volume of such product on the public 'net.

Car dealers openly beg Biden to put brakes on electric vehicle drive

Brilliant engineering...

To turn each wheel with an individually synchro-controlled electric motor was one of the most brilliant ideas in the history of automotive engineering.

To build a practical piece of equipment based on that idea, another related problem had to be solved: how to transfer the energy from a stationary terrestrial infrastructure all the way to the clamps on each one of those electrical motors.

To perform a slow electro-chemical reaction in-situ on a device that weights almost one half of the of the mass of the moving platform itself, and which does not decrease as the energy is consumed is probably the most idiotic idea in the whole history of engineering.

Remembering the time Windows accidentally sent Poland to the bottom of the sea

In the best of all possible Worlds...

...computer system designers would understand that:

1) Not everybody wants to run a computer clock based on their geographical time-zone,

2) There are countries where multiple languages are spoken,

3) There are languages that are not official languages in any country,

4) Country geographical borders do not make a categorical classification of planet surface.

Now Apple takes a bite out of encryption-bypassing 'spy clause' in UK internet law

The Red Pill and the Blue Pill

A very good paper was written on the subject way back in 2008 by Ben Laurie and Abe Singer: "Choose the Red Pill and the Blue Pill". Surprisingly, no attempt was ever made (that I know of) to put it in practice.

For the curious:

https://www.researchgate.net/publication/234832838_Choose_the_red_pill_and_the_blue_pill_a_position_paper

Why you might want an email client in the era of webmail

OpenPGP

May I suggest the ability to use OpenPGP merits one sentence in this article (and in any discussion of local vs. webmail use?). Unlike "encrypted mail" implementation in various web-mail services, this is just about the only secure communication method available, provided the user is capable to keep his end-point his own and secure.

https://support.mozilla.org/en-US/kb/introduction-to-e2e-encryption

Google adds stronger encryption for some Gmail users, in beta

OpenPGP

As far as I was able to find out, Proton is the only web-mail service that is fully interoperable with OpenPGP {https://www.openpgp.org/). (It does not implement W-O-T, but so does not - for instance - Thunderbird native OpenPGP).

Can somebody please correct me if I failed to identify another service?

Implementing "E2E mail encryption" only for the traffic between users of the same web-mail service vendor is pointless, even if done "lege artis" - which this is far from.

Meta offers $37.5m to settle location tracking lawsuit

How can this be stopped?

Expecting such behavior will be stopped by legal means is unrealistic.

There is unfortunately only one way to stop it, and we are still very far from it: what we really need are user device operating systems which make it reasonably simple for the owner to administer the device and control what an application can and what it can not do. The way things are now, a consortium of foxes not only raid the hen-house - they own and administer it.

Businesses should dump Windows for the Linux desktop

Package heroes

> Package maintainers are the real heroes of Linux - it’s a thankless, time-consuming job, but without them the whole ecosystem would collapse...

How very true!

Meta proposes doing away with leap seconds

Time is simple

Time is actually quite simple for those that understand high-school physics - among which Facebook coders don't seem to be.

Time is a physical measurement. The unit is called a second, and is defined via transition frequency of the caesium 133 atom. The most common time periods we measure in everyday life (and model in information systems) is the number of such units it takes the Earth to complete one rotation around it's axis (a "day") and the number of units it takes for the Earth to complete its rotation around the Sun (a "year"), both in the astronomical (extra-solar system) frame of reference. Neither of two is some even number of basic units, and, in addition, since they are both manifestations of behavior of irregularly shaped and geometrically unstable physical bodies, are irregular and variable over time and impossible to predict with anywhere near the same precision as that with which we measure time. (NB.: "impossible to predict...")

If those Metaverse self-proclaimed "software engineers" would carefully examine the above paragraph (and let it sink, over a period of time commensurate with their education in natural sciences), I am pretty sure they will understand just how absurd a call for doing away with leap second is.

Elon Musk flogs $8.4bn of Tesla shares amid Twitter offer drama

Build new or buy an existing

My experience with cost-estimating software/hardware/operations/marketing of IT ventures is several orders of magnitude below Twitter. But with some creative extrapolation, I estimate that re-creating and kick-starting the "new, improved Twitter", could not be more that one tenth of Musk's bid.

Is it really possible that the herd of its users is worth $200.- a head?

Biden issues Executive Order to tame digital currencies

What is "money laundering"?

As a recent arrival to your planet, I am somewhat baffled by the term "money laundering". I have never seen an authoritative definition, and the best I could come up with from the usage is "monetary transaction between individuals kept from the Government knowledge". If there is a better definition, please illuminate me; if not, why is it often used as a pejorative?

Theranos CEO Elizabeth Holmes found guilty of fraud: Blood-testing machines were vapourware after all

Good idea, aggressive pursuit of capital, greedy investors that didn't bother doing their due diligence, salting the samples to gain time, investors getting nervous and pulling the rug. Happened so many times before, will happen many times again.

The only thing I do not understand is why is this in criminal court instead of being a civil litigation between the two parties?

Foreign Office IT chaos: Shocking testimony reveals poor tech support hindered Afghan evac attempts

Catch 22

> ...not having actually prepared anything in advance to manage things...

No invading army in the history of warfare prepared for defeat. If it was smart enough to do that, it almost certainly would have been smart enough not to invade.

What's 2 + 2? Personal info, sniffs Twitter: Anti-doxxing AI goes off the rails, bans tweets with numbers in them

Re: No AI

Artificial intelligence does exist; just like artificial insemination. Both are substitutes, used by those not capable of the real version of the phenomenon.