Hacker News Reader

Comment by dcow | Hacker News Reader

Is Matthew Green some industry security personality that people respect? I appreciate this write up, it's interesting. But it seems motivated by his little Twitter rant the other day. Who is he beyond some Twitizen in a Guy Fawkes mask who hates HN? I don't particularly like his demeanor, at least from his rather naively uninformed tantrum the other day. Didn't seem very professional or respectable so I just wrote him off.

View on HN

Matthew Green wrote zerocash, the protocol behind zcash, and he teaches cryptography at John Hopkins.

When it comes to cryptography he knows enough to have opinions. It's hard to opine about black box systems, which is why open-source is so important. It's hard to trust what you can't verify.

Offline finding isn’t a black box system, though. It was presented at Black Hat, and there is a well-known 3rd party implementation. This feature brings offline finding to more cases.

In addition, if this person is a well-regarded professional, then indignant tweeting is even more concerning because the general public has no way of knowing that they’re just misinformed.

I don't disagree but like if you want an open system why are you using an iPhone? Maybe Green is a little guilty of slurping up Apple's privacy marketing?...

You can read more of his iPhone-related writing here: https://blog.cryptographyengineering.com/category/apple/

I'm not sure how concerned he is that it's closed source, I think in this case he was just surprised that the implementation details and security considerations weren't documented anywhere: https://twitter.com/matthew_d_green/status/14433822078386217...

Note that he was relatively positive about this feature when it came out two years ago: https://blog.cryptographyengineering.com/2019/06/05/how-does.... It seems like the motivation for this tweet was "wow I do a lot of iPhone security research and I didn't know this worked when the phone is off, I'm surprised Apple doesn't document the details of this anywhere." Remember that it's hard to interpret tone through the internet, and as someone that doesn't get a ton of engagement on Twitter, he probably doesn't feel like he's writing for a mass audience.

This is no surprise to me knowing Apple's history. Honestly I think I was just annoyed by his twitter personality, but I guess I shouldn't find "twitter personas found to be annoying" surprising either.

At this point, there's only two mobile OS players. All of these upstarts don't have enough market share to count (hopefully, just for now).

Nobody's family members use something other than iOS/Android. Maybe some of your friends do, but that's a small market.

With that established, just because one uses iOS/Android does not mean they are not about openess or security or privacy or whatever. It probably just means they are a human being that has only so much time in their life and they need a mobile device that works and operates with their friends and families. Just like why people continue to use FB/Twit/blah; that's where the people are.

Which is why his twitter thing felt so odd and uncharacteristic especially coming from a professor of cryptography nonetheless. AOP has been around for years. If he's made the concession to use an iPhone because that's where people are, why freak out about some new feature like you were born yesterday? This is Apple, you know they don't document shit. Go look at core crypto... it's doc-gen function signatures and structs. They don't even tell you how big their chacha20-poly1305 nonce is. The only reason they have a security handbook is so that the government would approve iPhone use. Why not look at the prior art out there surrounding the protocol published by people who are concerned like you are and weigh in as a security expert instead of having a twitter fit and then throwing HN under the bus when they point this shit out to you and say "hmm he's kinda overreacting this isn't news and actually the protocol is pretty good".

I totally agree this totally feels like someone making noise to get attention even though the subject is closer to a mole hill approaches mountain in stature.

I just think the attack "smart guy" for using iOS/Android meme is lame.

I mean I advocate for open systems that can be audited and verified and I still use an iPhone as a daily too although I've been exploring the pinephone on my other sim. I get it. That wasn't my intention to attack the smart guy for using an iPhone. More just like "what do you expect"?

Everyone is quite an absolute word. How are non apple users slurping up Apple's privacy marketing?

Edited.

https://en.wikipedia.org/wiki/Matthew_D._Green

Matthew Green is a well known Cryptography professional and has a ton of write ups on his also well known blog.

https://blog.cryptographyengineering.com/

You seem a little judgemental and obviously unaware.

Because he posted a bunch of admittedly pretty annoying Tweets based on angsty presumptions about stuff that someone who put in the effort to do their research and submit a real teardown and writeup rips apart. Being some crypto associate professor doesn't absolve you of the responsibility of doing your research before spewing off on Twitter. At least he's seemed to handle things with some amount of humility since then so I'll chalk this one up to having a bad day or something. I've actually read some of his stuff before I just didn't know him by name which is why I asked.

Heck, I hate HN.

"who hates HN"

This site, and this community, is great in my opinion. But it's not without valid criticism, especially considering the impact it can and has made in the industry and tech society.

"naively uninformed tantrum"

I'm unable to find the posts you're talking about.

Sorry if my distaste for these "I'm so cool look at me go" Twitter rants is seeping out here. If you go to his profile and scroll back a few days of posts you'll find them. Anyway it looks like he's humbled and corrected himself after seeing this writeup. Maybe I'll give him another chance.

> scroll back a few days

I did and I'm not sure what I'm looking for. Could you do it and post here so that I can verify what you're talking about?

Get a load of this I've got BIG NEWS I hope you're ready for my thread.

So it turns out APPLE did something I didn't know about.

My iPhone doesn't turn off anymore when I power it off if I select the option that says "go into low power mode so that my phone can still send beacons". Can you BELIEVE this?

FURTHER, unlike Google who would never let you turn this feature off, Apple does, but I have to GO INTO SETTINGS to find it OMG. And what a jokeshow marketing team Apple has because the name is a little confusing.

Somehow those bumbling buffoons over on HN found my tweet and half of them LIKE this feature. WTF! They're even discussing this thread like they like to do.

Thanks. Genuinely gave me a laugh. I predict HN mods won't be so humorous about it though.

I have net lost some karma. Probably should have put it all in one post but I don't think it would have had the same effect. It so clearly is silly and unwanted when you do something like that on this forum, and that was the point.

You're gonna get yourself rate limited. It's no fun.

You mean "a little bird told you I was going to get rate limited", don't worry I gotchu.

No, HN will rate limit you if you post too quickly. I've been hit with it when I was involved in a back-and-forth in the past (part of the reason I added a 2-minute delay to my posts becoming visible, plus it gives me a chance to reconsider if they're worth posting or make edits).

I know. I was just being deliberately annoying. Matthew Green's twitter thread includes an incorrect (but he has now walked it back since he's obviously now read the teardown we're supposed to be discussing here and which I've played my fair share in derailing) post about how "a little bird told him it works this way". Just more twitter bravado at the time.

Huh? How is that 'bravado'?

Reply on news.ycombinator.com