schlowmo

> "First it is important to understand what this encryption module is actually supposed to do and understand the threat scenario. The encryption provides no security against a malicious server operator, because the encryption happens on the server. The only scenario where this encryption helps is if one has a trusted server that is using an untrusted storage space."

While it's a good finding that even in this specific scenario the crypto-module is screwed up, I think an even bigger problem is that most people hosting owncloud either don't know or care about all threats not covered by this scenario.

I heard stuff like "Owncloud has crypto, so it must be secure." from people hosting owncloud on server they didn't have much control (especially physically) about. It's not only the "malicious server operator" but everyone with administrative access (legitimate or not) to this server.

But unfortunately I don't know a selfhosted easy-to-install-and-use alternative with strong client-side encryption, which boils down to: Dropbox (or any other cloud storage provider) with client-side encryption of your own choice is more secure than owncloud with only the crypto-module.

There was a question on Information Security (Stackexchange) about a year ago which was exactly adressing this issue:

https://security.stackexchange.com/questions/92512/how-much-...

This was a follow up of a more general and well received question (How critical is it to keep your password length secret?), where some of the answers imho are a really worth reading:

https://security.stackexchange.com/questions/92233/how-criti...

Hm, now wait for what could happen next:

https://news.ycombinator.com/item?id=11255160

I think unfortunately you're right with your thoughts about the perception, but this leads to very misguided customer happiness management crap.

Since it's well known that cashiers (especially at grocery stores, but in most countries this is a general thing) are not that well paid while the work is all about speed and efficency (aside all those unpaid overtimes, at least in German discounters), it tells much about prevalent work ethics.

It should be

"Why on earth should those people stand while doing this monotonous work everybody needs to get done?"

instead of

"Why are those lazy people are allowed to sit while taking my hard earned money?"

But I doesn't think that those customer happiness advocates do care much about those trivial considerations.

In Germany (where Aldi comes from) sitting behind the cash desk is the standard for grocery stores.

The math behind the security gain by increasing the key length of an RSA key seems slighly more complicated then one might expect. Here is a (short) introduction by the GnuPG folks:

https://www.gnupg.org/faq/gnupg-faq.html#no_default_of_rsa40...

Shorter version: RSA-4096 is roughly 28bits over RSA-2048 (112 vs 140 bits).

As far as I know: no. Whatsapp just implemented the (open source) signal protocol formerly known as Axolotl with the help of Open Whisper Systems. The rest of the IM "ecosystem" (like push notifications, contact recognition, server infrastructure etc.) is left untouched.

Neither is Open Whisper Systems or the signal protocol mentioned in this blog post, but maybe this would have been too much of advertisement for a competitor.

To be fair: whatsapp mentioned it at the other two links.

Point taken. If I talk to "normal" people, I wouldn't use the word "protocol" neither (or at least not as conversation starter). Normal-people-rephrased it's more like

"When whatsapp take the fundamental core from signal..."

I should use this as a strong argument for the rest of my no-please-not-another-instant-messenger-i-stay-with-whatsapp-contacts:

When whatsapp is implementing the signal protocol, why should one use whatsapp in the first place?[1]

I hope this good advertisement gives signal another round of traction.

[1] Ok, you've got me. The less techie contacts will swing the feature-bat and the other already use signal.

One could use this as an example to demonstrate the methodological weaknesses of the Turing test:

Random racist dumbhead: @TayandYou Do you hate black people?

Tay: @RandomRacistDumbhead i do indeed

Random racist dumbhead: Wow, this guy is more eloquent then most of my racist friends.

I think the "wrong shell incident" is quite common:

"Just need to load this dump to the testing database and I'm on my way to weekend...ok done...oh wait, if I look closer, this shell isn't the testing system...hell noooo, just nuked 8 hours of work each from 20 product managers."

Literally happend to me when I was a working student at a DAX 30 corporation. Never happend to me since then again.

No need to buy it, it's free:

https://www.gitbook.com/book/tra38/essential-copying-and-pas...

Found yesterday in this HN Story: https://news.ycombinator.com/item?id=11333448

Besides the reference to Fahrenheit 451 the referece to Life of Brian at the example from the RFC made my day:

https://tools.ietf.org/html/rfc7725#section-3

"Unavailable For Legal Reasons

This request may not be serviced in the Roman Province of Judea due to the Lex Julia Majestatis, which disallows access to resources hosted on servers deemed to be operated by the People's Front of Judea."