Notices by saxnot [offline b/c festival] (saxnot@chaos.social)

Suche: Ausbildungsplatz Tiermedizinische.r Fachangestellte.r nahe #Braunschweig / #Hannover oder so

:-) :BoostOK: :BoostOK: :BoostOK:
#fedihelp #ausbildungsplatz #ausbildung #Ausbildungsmarkt #followerpower

@JulianOliver that's so sad so see! Buzzfeed did award winning journalism (despite the jokes we do about it) and seeing it run into the ground is sad

Can someone sell me a good laptop at #39C3?

Currently I use a ThinkPad X220 but it has hardware issues I was unable to fix.
I'm quite content with another ThinkPad or similar

Can someone sell me a good laptop at #39C3?

Due to circumstance I am not sensitive to price

@thomasfuchs real time ray tracing is a challenge even to this day iirc

@ryanc @jhwgh1968 hm ok

Some people are just built different. My optician which I meet about once per year always recognizes me instantly and asks about my siblings which she knows the names of perfectly.
But she does that memory black magic to everyone I am not special.

@dansup i feel like this has been invented before

@evan uh… never?
perhaps twice in my whole life

@feld thanks for the source

last time I checked the mtproto had such an obvious flaw to diffie-hellman it would have been a beginner question in crypto 1 at my uni (and my uni is worst in the country for c.s.)

we're only talking about the secure chat feature here. Every other chat (nearly 100 %) is still unencrypted (and they're open about that).

They sometimes communicate this premise in a way very confusing to the uninitiiated

@feld of course I could say "it's not floss, thus can't be independantly audited, thus immediacy no go for people interested interested in information security.
But that would be too much of an easy W I should stay within my original claim of them having no encryption at all

@feld excuse me did you just say "unconventional choices" in regards to cryptography?

I am sorry there are ways that stand the test of time and everything else is flawed.
That's how cryptographers think about these things and for a good reason.

Do I want a heart surgeon to be known for their "unconventional choices"? No. That's like the ultimate flaw in that industry of knowing it better in an otherwise peer reviewed world

@feld that format verification is five years old
just saying that.

I was unaware that formal verification of such complex systems is even possible.

not even AES is formally verified and it's magnitude simpler in design

@feld i know this source is old but just look at the this 2017 blog article by Pavel Durov: https://telegra.ph/Why-Isnt-Telegram-End-to-End-Encrypted-by-Default-08-14

it immediately opens with the most far-fetched and niche argument ever. All of E2EE is not what you truly want because... some users to unencrypted backups.
The same users would do the same backups for telegram but let's ignore that.
All of Telegram shall have no E2EE because they leak it anyway.
Signal is niche and cringe (didn't use the latter word) because they encrypt backups

@feld it's a funny read and it's certainly an important building block when that was his opinion in 2017.

It's correct that not having #E2EE is more convenient. And that in itself is a valid reason. But then advertise as "simple and hassle free" and don't pretend to offer any security in #Telegram

In case I wasn't clear: I am finished looking at the formal proof because I don't have that software and I see no link to the results / paper / etc.

According to german security expert…

@feld According to german security expert @kuketz in his blog article from 2020 there is at the time no audit for the Telegram MTProto 2.0 protocol.
https://www.kuketz-blog.de/telegram-sicherheit-gibt-es-nur-auf-anfrage-messenger-teil3/

Correct me if that is wrong. The first MTProto was broken in a very amateurish way. The second not audited at all to my knowledge.

I like to believe Telegram being an unattractive target for audits anyways since it's closed source and publicly criticizing tools of the russian state might be bad for your health
#telegram

@feld the claim of them using the same E2EE with communicating to the server is laughable.

They most likely use TLS like every other sane person.
In fact using TLS for secret chats would be a much smarter idea in the first place rather than rolling their own crypto which is known in the industry to be a failure only the most inept security engineers do.

Every crypto is insecure unless shown otherwise.
AES, GPG, EC, … have been spotless since decades and that's why they're trusted

I don't understand why #Telegram is so popular
it's the worst messanger in regards to security by far.

There's no encryption, even 'secure chats' have a broken impl since years and russian gov reads and manipulates all.

Lots of nice features though

Empathy and reason is punk as fuck these days

mir zu viel Mühe geben meine Rasierklinge sicher zu verpacken vorm wegwerfen: check

Diese Dosen von EXTRA Kaugummi sind transparent und dickwandig. Plus es war Müll den ich eh im Müll hatte. Perfekt also!

@helix ne weiß ich nicht

meine Rasierklingen kommen in einer kleinen Plastikhülle. Ich könnte die stumpfen in der selben Hülle ganz unten lagern. Meinst du das?