andrewnicolalde

How's the weather in St. Petersburg?

This has to be the funniest and most gratifying thing I’ve ever read on Hacker News. Great job!

What’s the value in that vs a small note in README.md or similar?

If you're in the US like I am, I think it's because the BBC redirects all non-UK visitors to BBC.com, and so when you hit the back button from BBC.com you get sent back to BBC.co.uk which in turn redirects you to BBC.com. It gets on my nerves too.

I've been searching for something like this for a very long time! Nice to know it exists :)

We have no real way of knowing. AES is considered secure because, as far as is publicly known, it has sufficiently withstood attacks performed by many, many skilled cryptanalysts. As far as I am aware there is no reason to believe that AES provides anything less than its stated level of security. But again that isn’t to say it’s impossible.

This is very cool, thanks for sharing!

I notice at the end you imply that a senior software engineer claiming they weren’t rolling their own crypto because they used OpenSSL was doing so in error. What sorts of issues could arise if they were using OpenSSL to handle cryptography? Or was it that they were trying to use low level APIs in OpenSSL to create some higher-level cryptosystem they perhaps didn’t fully understand?

I actually have a sticker of ECB Tux[1] on my laptop to serve as a fun reminder :P

[1] https://filippo.io/images/Tux-ECB.png

Wow, I had no idea this was also the case on Windows! I was aware of this on X11 and switched to a Wayland compositor as a result. Is this true for macOS? I know for sure that on more recent versions of macOS, applications which want to capture the entire screen require special user-approved permissions, but can they selectively read other windows?

Thanks for the heads up :)

Could you elaborate on that? Of course no computer is completely secure against all forms of attack, but I’ve found statements like these to not contribute very much towards solving any practical security problems.

Perhaps. I'm American but live in the UK, and I have observed how people in the UK use "don't" as opposed to "doesn't" when the thing being referred to is an organisation, I suppose with the idea of it being an organisation comprised of many people (i.e. "they don't") as opposed to an inanimate non-human entity ("it doesn't").

Still incorrect to my understanding of how English works.

I'm pretty sure GDPR applies to any companies with dealings in the EU, or at least to that company's dealings which occur within the EU.

Disclaimer: IAANAL

It caught me off guard too. The company is UK-based so it's probably a British colloquialism.

*uninstall

As an aside, the Chrome cookies database on Windows is protected using the Windows Data Protection API[1], which ties encryption keys to a specific user. In the case of the Chrome cookie database, each cookie's payload/value is encrypted using a cryptographic key generated by the DPAPI which is only accessible to that Windows user. Of course, (and as is the case with most situations like this), this does absolutely nothing to protect users against malicious or intrusive programs running with the permissions of that user.

So yeah, you're right. App sandboxing please.

[1] https://en.wikipedia.org/wiki/Data_Protection_API

It had excellent chat functionality that worked well, and this was at a time in which the Signal client for Android was still quite buggy (hundreds of Bad encrypted message messages flooding group chats, messages delivered hours late and all at once, poor performance etc.) My group naturally gravitated towards Keybase as our secure messaging platform. The other killer feature was KBFS, which was a sort of shared encrypted filesystem with which you could sync files securely across all of your devices, share files publicly or with specific users or sets of users or groups in cryptographically protected ways.

The unintelligible foray into cryptocurrency with Lumens made very little sense to me, but apparently the coins I was gifted for free by Keybase are worth over 100 USD now. I'll probably hold on to them.

Why not, if that’s where a majority of the teams making engineering decisions are?

Except you are UNinstalling the application? What cause is there to save anything that isn't already there at that point?

That's brilliant, thank you for making me aware of this!

This looks more like them actively placing a cookie into the cookie DB upon install. Doesn't appear to be simply left behind.

> I love how when you go to enter a Zoom meeting, they bury the no-install, run-in-browser link in small type in a footer.

I wasn't even aware that was possible until now.

Same, they were my preferred platform for secure messaging, which is bizarre when you think about the fact that this wasn't even their original purpose. I guess this was indicative of the general lack of a single defined direction the product was going in near the time of the Zoom acquisition. What a shame. Hopefully someone makes something similar.

Disclaimer: I used to work at ThreatSpike Labs but left before this article was written and before any of the findings on this article were discovered.

This made my day hahahaha. How long do you reckon it would take for someone to catch on?

Are you actually being downvoted for suggesting this?!

Does virtualization work?

Uhhhh, are you suggesting you can’t make money making software?

There certainly is. I have done this with a non-payment card. All you need is a magstripe reader/writer. A few tens of passes of writing random data to the magstripe should do the trick.

Not sure how this would impact the usability of your card though, in case you do end up relying on the magstripe.