andrewnicolalde

I understand. Apologies if I came off as confrontational. You make good points.

Does one of those choices seriously not sound worse than the other?

By following this oppressive law to "serve those users," Apple and Google appear to be partaking in the oppression of those users.

Curious, I thought I'd noticed issues this morning at around 6 AM CST, I wonder if it has something to do with that. Hopefully this doesn't result in any dropped emails that arrive at Fastmail during this outage..

edit: Looks like no mail has been lost.

If you mean when registering for a new account, annoyingly you need to physically have each key with you to register it with a new service. Biggest flaw in the spec IMO.

Second yubikey ;)

Can I ask what networking gear you run at home these days?

I desperately want there to be a series of books written in this universe.

Or use two security keys, one on your root user and another for your own personal IAM user, but you're right, don't use your root user for everyday tasks.

Better link directly to page: https://ec.europa.eu/transparency/regdoc/rep/1/2020/EN/COM-2...

From page 931/932[1]:

5.4.Protocols and Standards to be used for encryption mechanism: s/MIME and related packagesThe open standard s/MIME as extension to de facto e-mail standard SMTP will be deployed to encrypt messages containing DNA profile information. The protocol s/MIME (V3) allows signed receipts, security labels, and secure mailing lists and is layered on Cryptographic Message Syntax (CMS), an Internet Engineering Task Force (IETF) specification for cryptographic protected messages. It can be used to digitally sign, digest, authenticate or encrypt any form of digitaldata.The underlying certificate used by the s/MIME mechanism has to be in compliance with X.509 standard. In order to ensure common standards and procedures with other Prüm applications, the processing rules for s/MIME encryption operations or to be applied under various Commercial Product of the Shelves (COTS) environments, are as follows:

–the sequence of the operations is: first encryption and then signing,

–the encryption algorithm AES (Advanced Encryption Standard) with 256 bit key length and RSA with 1024 bit key length shall be applied for symmetric and asymmetric encryption respectively,

–the hash algorithm SHA-1 shall be applied.

s/MIME functionality is built into the vast majority of modern e-mail software packages including Outlook, Mozilla Mail aswell as Netscape Communicator 4.x and inter-operates among all major e-mail software packages.Because of s/MIME's easy integration into national IT infrastructure at all States' sites, it is selected as a viable mechanism to implement the communication security level. For achieving the goal 'Proof of Concept'in a more efficient way and reducing costs the open standard JavaMail API is however chosen for prototyping DNA data exchange. JavaMail API provides simple encryption and decryption of e-mails using s/MIME and/or OpenPGP. The intent is to provide a single, easy-to-use API for e-mail clients that want to send and receive encrypted e-mail in either of the two most popular e-mail encryption formats. Therefore any state-of-the-art implementations to JavaMail API will suffice for the requirements set by Title II [Exchanges of DNA, Fingerprints and vehicle registration data] of Part Three, such as the product of Bouncy Castle JCE (Java Cryptographic Extension), which will be used to implement s/MIME for prototyping DNA data exchange among all States.

Curiously, the phrase "JavaMail API provides simple encryption and decryption of e-mails using s/MIME and/or OpenPGP." appears to be taken directly from this[1] SourceForge page from 2004

[1]http://javamail-crypto.sourceforge.net/

I personally really enjoyed “HTTP Desync Attacks: Request Smuggling Reborn”[1]

This was technically very late 2019 but I didn’t see it in the previous 2019 thread.

[1] https://youtu.be/_A04msdplXs

Hey, that's my tweet :)

Only affects unlocked devices at rest, though at that point they could just open the Signal app. What's more intruiging is how they might have managed to bypass the security features in the Android Keystore[1] to obtain the decryption key.

[1]https://developer.android.com/training/articles/keystore

I wholeheartedly disagree. No matter how terrible? Seriously? What if an oppressive government asks for a list of religious minorities? A list of people with with certain medical conditions?

LOL, but what would happen if that computer was in active use?

What are your impressions so far?

Same

Probably anyone else in the Five Eyes, especially the UK.

That is very unlikely considering it would probably be a GSuite account.

How much access did the cryptography community have to Crypto AG’s cipher machines? I thought those were mostly sold to foreign military/diplomatic missions.

Something tells me your computer is plugged in ;)

Which vulnerabilities?

I am absolutely shocked that the initial encryption key is literally the md5sum of "ubnt".

https://gchq.github.io/CyberChef/#recipe=MD5()&input=dWJudA

I wonder what the folks at HostiFi (cloud hosted UniFi controller software) might be thinking right now...

edit: Looks like they've seen it. Their response is here: https://twitter.com/_rchase_/status/1329949952408244231

By the original maintainer of CUPS too it seems.

> We are way beyond the point where hospitals are horribly overwhelmed

I ask as someone who genuinely doesn't know either way, but is there a realistic risk of this happening again?

LOL, what happened then?

Indian medical records?

So many of these domain names sound like plausible names of name-brand prescription drugs..

This is exactly that sort of issue.

> If it doesn't work reliably and people end up copying/pasting passwords, that's not the "most secure".

Why not?