Hacker News Reader

ementallyon The Yubikey Is the Digital Seatbelt We Need

https://ninjalab.io/eucleak/ the timing lol

Extraction of the ECDSA secret key of Yubikey 5 series FIDO devices

ementallyon Essays: NSA Surveillance: A Guide to Staying Secure – Schneier on Security

>basically Tor Browser with the VPN instead of Tor-gateway.

You don't need a Mullvad VPN for it work, you can use it without Mullvad VPN or any VPN at all.

ementallyon Is Telegram really an encrypted messaging app?

Yes, https://www.androidpolice.com/telegram-germany-user-data-sur...

ementallyon Is Telegram really an encrypted messaging app?

>One of the biggest privacy problems in messaging is the availability of loads of meta-data — essentially data about who uses the service, who they talk to, and when they do that talking.

>I am not specifically calling out Telegram for this, since the same problem exists with virtually every other social media network and private messenger.

In fact, https://simplex.chat/ is the only messenger with the least amount of metadata.

ementallyon Atlas: A Windows modification to optimize performance, privacy and usability

https://www.vice.com/en/article/m7bv4b/windows-for-gamers-ro...

>An operating system marketed to gamers disables a host of Windows security features enticing users with promises of a smooth gaming experience which they may not realize is opening them up to potential attack.

ementallyon XMPP vs. Matrix

See "We plan to add:"

https://github.com/simplex-chat/simplex-chat?tab=readme-ov-f...

but the first 2 points were already implemented as shown in their Roadmap[1], so they are going to probably remove them

[1]: https://github.com/simplex-chat/simplex-chat?tab=readme-ov-f...

ementallyon XMPP vs. Matrix

https://simplex.chat/ has lesser metadata than Signal[1][2], Matrix and XMPP. SimpleX Chat is going to move to Groups V2[3] very soon to make the experience much better.

[1]: https://www.ndss-symposium.org/ndss-paper/improving-signals-...

[2]: https://arxiv.org/abs/2305.09799

[3]: https://github.com/simplex-chat/simplex-chat/issues/4620#iss...

ementallyon Age is a simple, modern and secure file encryption tool, format, and Go library

https://www.kryptor.co.uk/ is much more secure than age.

From their FAQ [0]:

>Kryptor uses strong, fast, and modern cryptographic algorithms, offering post-quantum security. It also addresses security limitations of tools like age and Minisign.

>Unlike most tools, Kryptor limits metadata by using an indistinguishable from random encrypted file format. Encrypted files have no identifiable headers and are randomly padded. File names can also be encrypted.

And from their Secure section [1]:

>Private key encryption for protection at rest, unlike age.

[0]: https://www.kryptor.co.uk/faq#why-should-i-use-kryptor-over-...

[1]: https://www.kryptor.co.uk/#secure

ementallyon Linux Hardening Checklist

I doubt a 5 year old hardening is any relevant today. I would stick to a well researched article like Privsec[0] where they explain the reasoning for each step.

[0] https://privsec.dev/posts/linux/desktop-linux-hardening/

ementallyon Transcribro: On-device Accurate Speech-to-text

Reason https://www.privacyguides.org/en/android/#f-droid

ementallyon RegreSSHion: RCE in OpenSSH's server, on glibc-based Linux systems

https://dustri.org/b/notes-on-regresshion-on-musl.html

ementallyon Don't use pixelation for redacting text (2022)

Blurring is also terrible https://scholarworks.uark.edu/cgi/viewcontent.cgi?article=10...

ementallyon Telegram has launched a pretty intense campaign to malign Signal as insecure

No worries, but it is a legitimate attack vector given that sandboxing on Linux sucks unlike Windows and macOS, so it is much needed.

There's an issue open to provide a flatpak for the app.

https://github.com/signalapp/Signal-Desktop/issues/1639

ementallyon Telegram has launched a pretty intense campaign to malign Signal as insecure

>Given how the posted described the optional `--no-sandbox` flag as "no sandbox on Linux", it's clear that they don't understand anything they're sharing, and they just want to spread FUD.

Could you elaborate as you seem to be more "knowledgeable". This flag is clear at what it does and shouldn't be shipped into production. https://no-sandbox.io/

You can have a look where they specifically chose to force it https://github.com/signalapp/Signal-Desktop/commit/1ca0d8210...

ementallyon Telegram has launched a pretty intense campaign to malign Signal as insecure

Well... if you scrolled up a bit you would have found https://discuss.privacyguides.net/t/according-to-elon-musk-s... which says Signal isn't great either.

ementallyon Telegram has launched a pretty intense campaign to malign Signal as insecure

FSB vs CIA?

You can check this thread where his claims are debunked https://discuss.privacyguides.net/t/according-to-elon-musk-s...

ementallyon All Linux distros using fwupd package open web server on 0.0.0.0:27500

Sorry I should have clarified, brace removes passim from fwupd which is the source of the issue.

https://github.com/divestedcg/Brace/commit/a19e29274ae748016...

So it is basically a bloatware removal tool for handpicked applications and not an alternative to fwupd.

ementallyon PeaZip: Open-source file compression and encryption software

MOTW support enabled by default https://github.com/nmantani/archiver-MOTW-support-comparison...

ementallyon All Linux distros using fwupd package open web server on 0.0.0.0:27500

Source: https://news.ycombinator.com/item?id=40322408

Alternative for fwupd: https://github.com/divestedcg/brace

ementallyon Proton Mail discloses user data leading to arrest in Spain

This is not the first time they have provided recovery emails to the feds.

https://www.forbes.com/sites/thomasbrewster/2023/08/08/proto...

Archive: https://web.archive.org/web/20230814144638/https://www.forbe...

ementallyon How Do I Prepare My Phone for a Protest?

Linux phones sucks tho https://github.com/beerisgood/Mobile_Security#linux-phones-l...

ementallyon The IMEI Code: Your phone’s other number

You can, but it is not that easy and you also need to change your IMSI.

https://invisv.com/pgpp/ for IMSI (not available worldwide)

https://github.com/srlabs/blue-merle for IMEI, a nice guide written by them explaining how it works https://raw.githubusercontent.com/srlabs/blue-merle/main/Doc...

You can follow this thread for more info https://discuss.privacyguides.net/t/cell-towers-tracking-net...

ementallyon The IMEI Code: Your phone’s other number

You can use https://github.com/srlabs/blue-merle if you want to change your IMEI

>The blue-merle software package enhances anonymity and reduces forensic traceability of the GL-E750 / Mudi 4G mobile wi-fi router ("Mudi router")

>Mobile Equipment Identity (IMEI) changer

>Media Access Control (MAC) address log wiper

>Basic Service Set Identifier (BSSID) randomization

>MAC Address randomization

ementallyon Tribler: An attack-resilient micro-economy for media

Great project, but can the devs comment on https://lists.torproject.org/pipermail/tor-dev/2014-December...

>[tor-dev] N reasons why the spooks love Tribler (Number N' will surprise you)

ementallyon Sandboxing all the things with Flatpak and BubbleBox

> F-Droid is "insecure" (I can't address this one because I don't understand the point of view and I've never seen it clarified)

https://privsec.dev/posts/android/f-droid-security-issues/

ementallyon Personal VPN services are snake oil

Author linked to privacytools.io.

>even better, a browser built with privacy in mind

which is full of VPN ads https://www.privacytools.io/privacy-vpn. Browse https://www.privacyguides.org/en/vpn/ better.