bantering with punk was Re: What advantage does Signal protocol have over basic public key encryption?

26 Jan 2021

      ...
...
...
So, I think your understanding of so misleadingly called 'perfect
forward
secrecy' isn't right.
I don't remember the protocol really well to hold up my end here,
this isn't only about the signal protocol but about any protocol that
advertises 'perfect forward secrecy' and uses 'public key cryptography' of
the kind that's vulnerable to attacks using 'quantum computers'.
Do you mean that it is incredibly misleading to advertise
cryptographic safety when there is obviously an increasing degree of
unpublished research that counters it?

I'm not sure what you're saying here.  Wouldn't it be fine to just add
a note that those are cryptographic terms, and do not technically
guarantee perfect privacy in the face of time travel?
...
...
and  i don't really trust that you're relating forthrightly to revisit it
much.
yeah well. I think I explained the basic problem twice. You don't need to
'trust' me but do your own research.
Yeesh you removed the quote and stated you had explained it already.
I don't remember what we were talking about, but it was clear that if
you had done research it yielded very different information than what
I see.
...
...
does signal use diffie-helman key exchange?
yes it does. You're the one pimping it, you shoud know.
Blargh, links help here.  Okay, my best memory is that you were
worried about a key exchange compromise in the face of a website on
how dh is dangerous.  I'll look it up right now.

https://weakdh.org/ is only about SSL and specifically chosen prime
numbers.  These are implementation errors, not compromises of the
protocol or the primtiive.

I vaguely recall there is something more serious regarding dh
exchange, dunno.  What's relevant is that signal is far better than
the plain text email we are communicating over right now.

It is incredibly helpful to drink not enough water when you are very thirsty.
...
...
does it do it in a
way that website describes as known to be vulnerable?
...see your first unfounded claim about 'perfect' secrecy. DH is
'vulnerable' to 'advances in solving the discrete log problem' bla bla.
Not only that, once you research personal teleportation devices door
locks become very vulnerable, too.

It's not hard to make a personal teleportation device.  All you need
is a bunch of enslaved makerspaces, economists, physicists, and
inspirational coaches.  Get them to organise themselves into groups
based on their skills and passions and force them to focus on
inventing personal teleportation for a decade straight.  Have a daily
check-in where everybody debates whether or not what they are
currently doing is the most effective thing they could be doing, for
personal teleportation.

Also I have a commodity here whose value raises more than the interest
rate on loans, every three years or so, so mathematically we should be
able to steal all the money from the whole planet.  It's growth is
reducing, but too slowly to validate physics.
...
...
...
What I think is important to understand is that signal is a
centralized
service and the owners are not to be trusted, at all. Moxie morlonpoke
That's the whole point of end-to-end encryption.
Not sure what you mean. So called end to end encryption only encrypts
messages. It doesn't magically solve 'traffic analysis' problems.
Neither does decentralisation.  I was responding to your mention of
centralisation.

It is weird that signal uses centralised servers.  Maybe to reduce
development load.  It's always sketchy the compromises made by
communities struggling to effect change.  It's possible it's just
communication issues.

The point is that we need an ANONYMOUS BLOCKCHAIN-BASED MESSENGER TO
REPLACE SIGNAL in these times of disruption, and signal would pay
anybody to contribute the backend in a way they accept ;P
...
...
...
perfectly fits the profile of 'progressive' pentagon agent. So maybe
the
The only people who believe these people are real agents, and not just
people secretly drugged and abused by agents, are acting more as the
agents than they are.
bullshit.
Yeah?  Which is more productive, arguing on a list where nobody
replies to what you say or making software that increases privacy?
...
...
...
'end to end encryption' works, but signal remains a US metadata spying
operation, 'endorsed' by the likes of the 'ceo' of twatter. Hard to get
a
bigger red flag than that by the way.
Nah it's more like a bunch of people subjected to international spying
operations figuring out the charades work that lets them escape a
little bit.  Also, free technology for others!
more bullshit.
Yeesh!  Signal can poison our souls with technology, and dangerously
reveal everything we do to the people who want to hurt us (BECAUSE IT
RUNS ON A PHONE, NOT BECAUSE OF ITS PROTOCOL), without being some
intentional attempt by cryptographers to harm the universe.

Before signal people were using NOTHING.  NO ENCRYPTION AT ALL.  Some
of them were using encryption where a corporation and government could
freely decryption EVERYTHING, and was lying about it.  SOME of them.

Caps intended with love and care and embarrassment.  I don't deserve
to write in caps.
...
...
...
...
When they say "metadata that the signal servers have
access to" or "does not prevent a company from retaining information"
they are talking about much smaller bits of data than people usually
talk about.
.....I think it's rather clear what 'metadata' we're talking about.
Signal
knows who talks to who and when.
It doesn't sound like it's clear to you.  Metadata lives in bytes that
travel over network protocols and are analysed by algorithms.
Anyway, yeah, PGP doesn't encrypt the message subjects and recipients.
I don't recall the protocol well, but the way the ratchet protocol
works there was a lot more possibility for encrypting per-message
metadata.
...
...
Somebody has probably upgraded the concept now that deepfakes and such
are normal.
what are you talking about
Well, I don't know the cryptographic terms, but you're possibly
talking about information that can be extracted from messaging by
algorithms, like traffic analysis, as comparable to metadata, like the
subject on an email or the location tagged on a jpeg photo.

Nowadays machine learning is _way_ better at profiling stuff than just
traffic analysis.  With deepfakes, there is a research war between
making fake media, and identifying that media is fake.  That's
incredibly dangerous.  Both groups will split off into private
research and nobody will know what is going on, a handful of people
believing they do.  The research should be around reducing the reasons
that people make deepfakes, not around identifying them.

But since we can automatically identify whether a photo has very
subtle attributes that only happen in reality, while people are
actively researching preventing that, we can probably identify who a
person is by what kind of things were bought at stores near them, and
such, too, because people trying to be anonymous do not have
datacenters full of gpus researching how to stay that way.

Karl

Punk-BatSoup-Stasi 2.0

Karl

Punk-BatSoup-Stasi 2.0

Karl

Karl

Karl

Punk-BatSoup-Stasi 2.0

Karl

Punk-BatSoup-Stasi 2.0

Karl

Punk-BatSoup-Stasi 2.0

Karl

Punk-BatSoup-Stasi 2.0

tags

participants (2)