45h34jh53k4j

MiTM as a service. Install their root certs on your ios and android devices, no thanks!

Signal has a chrome app that performs as a desktop client.

Until the next 100 million dollar loss.

"The die has been cast"

its a signing bug.

There have been incidents of 'accidental inflation' of fully-anonymous cryptocurrencies (as opposed to 'semi-anonymous' [sender/receiver anonymous] and pseudonymous bitcoin).

Zerocoin had a 1/4 inflation from https://news.ycombinator.com/item?id=13672117

I wouldn't go so far as to say this is will prevent this technology from ever being secure. Its early days. Don't play with what you can't lose.

The great monero team did notify other CryptoNote based currencies, it seems that the granddaddy Bytecoin didn't fix it before the notification period. There is no evidence that they exploited this. They even came up with a method for detecting if it had been exploited...

WannaBet? https://twitter.com/hackerfantastic/status/86335937578792550...

"The CIA has a different health insurance plan from the State Department. The premium records, which are unclassified and usually available to local employees, are a dead giveaway."

I wonder if this is still the case? Seems like a very externally observable difference, especially today.

GeoBoy from NGS software!

Bitcoin has had several drastic price corrections in its life. We are yet to see this from Ether. I suspect the fall will be greater if it starts >$100.

Of course, we will look back on this in 5 years and think $100 ETHER was cheap!

I am also very interested in proof of this. So far we have no evidence of mass downgrades on TLS, its not in any of the leaked docs. Tempora is a GCHQ/NSA passive capture technology.

Edit: Are you sure it isn't an old version of OpenSSL on your host? Last time i checked most IRCd's did SSLv3 (IRC crypto is awful btw.. stop using it)

So what you are saying is that only the wealthy deserve good quality healthcare? Good plan.

In my experience, Online advertising is overwhelmingly negative.

Lets compare it to cancer. Maybe the users don't want brain cancer, but they should have the option for skin cancer.

Nobody wants cancer. Users who install adblockers don't want ads.

We have a software marketplace for items under a GNU license. # apt-get install package

I would say you will fail most spectacularly, but it seems to work for RedHat Enterprise Linux

fake reviews on the affiliate site: more unique affiliate site links to more apps, more revenue

fake reviews on the app store: increase app profile and visibility, secondary feeder to your affiliate site via organic; Maybe affiliate site uses app store category top 20 lists to generate its links?

Streisand is a good idea, but I don't believe users want 500 services running on their VPN gateway. Most of these protocols require a specific client, like OpenVPN. This is a 'kitchen sink' collection.

TrailOfBits released their ansible scripts for StrongS/WAN, which has sensible secure defaults (IPSec using AES-GCM only). They are calling the project algo.

https://github.com/trailofbits/algo

because encryption in transit != encryption at rest. Maybe you don't trust the server you are scp'ing the data to, with encryption at rest you dont' need to.

NoScript is not enabled by default in Tor Browser (in tails).

from: https://tails.boum.org/doc/anonymous_internet/Tor_Browser/#i...

To allow more control over JavaScript, for example to disable JavaScript completely on some websites, Tor Browser includes the NoScript extension.

By default, NoScript is disabled and some JavaScript is allowed by the Torbutton extension as explained above.

So, "Yes", this is reckless and would compromise Tor Browser from the outset.

A brain drain of skilled information technologists from the UK will also drive home this message to the authorities.

Consider EU or US

I think one should reconsider purchasing products or services from UK companies. Economic impact will be the only force that changes these laws.

Hoping that the RIPA laws do not apply to your communication provider product or services is wishful thinking.

When they come for your metadata, or want you to back door your customers, one must either shut down or comply.

Yeah, Nah;

Maybe something like this is more useful to you if you wish to control what services have internet access: https://github.com/subgraph/fw-daemon

Private keys accessible to the browser is the worst model. I don't think this was ever taken seriously at Google either...

Requires private keys to loaded into the browser extension. No thanks! Google's E2E is the same, which is to, say garbage.

So much fun filling my life with inanimate fragments of plastic and metal. All that matters is the code; in 200 years do you think people will marvel at old PCBs? I doubt it, but the code will forever be beautiful.

Dear IshKebab,

We at startup xyz take security seriously. We regret to inform you that on the night of 1st December 2016 our database was compromised. The database contained your name, address and fingerprint data.

Please see a plastic surgeon about resetting your fingerprints at as soon as possible.

Thank you, Startup Xyz

Prison. RICO act for running a large criminal enterprise that defrauded millions. Any other industry fraud at this scale would see the dismantling of the enterprise!

GCHQ -- NSA without the ethics, answerable only to the King

Im surprised nobody has mentioned Quellen-TKÜ -- is there any evidence that governments can force handset vendors to push malware to devices?

I don't believe this, as it would make programs like QUANTUM* unneeded. Why subvert global internet infrastructure if the providers do the dirty work?

This would be explosive if true

So we have learned that some phone vendors give Cellebrite their phones before they reach market in order for them to discover and exploit vulnerabilities. Apple refuses to do business with these 'forensic' criminals.

Do not purchase a phone from a vendor that engages in this unethical practise.

It will be interesting if Apple went after Cellebrite under the DMCA anti-circumvention clauses. I would laugh if their product became illegal in the United States.

Nah it's not the same thing. Client Authenticated TLS provides a mutually authenticated channel. Mutually authenticated channels cannot be man-in-the-middled. The auth is happening at the transport layer.

A login through a QR code (basically a token) is just normal TLS with the same MiTM risk. Its just an application layer login.