Hasty Briefsbeta

All tags

#encryption

136 stories total

Bilingual

OpenADP, needs volunteers to help prevent mass secret surveillance
10 months ago
- Apple removed end-to-end iCloud encryption in the UK due to government demands for backdoors.
- OpenADP is an open-source alternative to Apple's Advanced Data Protection, designed to resist government backdoors by distributing trust across multiple servers in different jurisdictions.
- Governments worldwide are pressuring tech companies to weaken encryption or provide backdoors, making single-company systems vulnerable to mass surveillance.
- OpenADP uses threshold cryptography to split cryptographic secrets into shares stored on independent servers, requiring cooperation from multiple jurisdictions to access data.
- The system ensures data remains accessible even if some servers fail or are compromised, maintaining user privacy without single points of failure.
- OpenADP offers a simple user interface, hiding complex cryptography behind password-based access, similar to existing services.
- The project encourages participation from individuals, startups, and enterprises to run nodes, integrate APIs, or develop applications using OpenADP.
- OpenADP aims to balance privacy and legitimate law enforcement needs by requiring multi-jurisdictional cooperation for emergency data access.
- The system is open-source, auditable, and designed to prevent secret backdoors, offering transparency and community verification.
- OpenADP provides real-time monitoring of server health and network status, with all data publicly available for verification.
FOKS – The Federated Open Key Service
10 months ago
- FOKS provides secure, end-to-end encrypted Git hosting with data encrypted before sending to the server.
- It uses modern PQ-secure public-key cryptography to protect against quantum attacks.
- FOKS implements Git atop an encrypted key-value store, allowing storage of strings or large files.
- Features a federated team management system supporting complex team topologies and cross-server teams.
- Device management includes YubiKey support and cascading key-rotation upon device revocation.
- Uses a key hierarchy with base-level keys, per-user keys (PUKs), and per-team keys (PTKs).
- Employs signature chains and Merkle Trees to prevent server tampering and ensure data integrity.
- Focuses on simple, hardened cryptography, avoiding complex schemes like VRFs or SNARKs.
- Open-source under MIT license, with no vendor lock-in, supporting federation like email or the web.
- Easy installation via package managers (Chocolatey, Homebrew, apt, dnf) or static binaries.
- Future directions include encrypted SQL, calendar, and more, with community-driven development.
Public Signal Backups Testing
10 months ago
- Signal is testing a new end-to-end encrypted backup system on Android.
- Backups are hosted by Signal, ensuring data safety even if the device is lost.
- Features include dynamic media offloading to save phone storage space.
- Supports cross-platform backups (Android to iOS).
- Free tier backs up text messages and recent 45 days of media.
- Paid tier offers 100GB of media storage.
- Backups are end-to-end encrypted and disabled by default.
- Signal cannot associate backups or payments with specific users.
- Testing is available via a self-updating APK on staging servers.
- Feedback requested on bugs, UI clarity, missing features, and performance.
- Local backups will be improved with a new cross-platform format.
- Disappearing messages with less than 24 hours to expire are excluded from backups.
- View-once messages are always excluded from backups.
- iOS testing is more challenging due to platform restrictions.
- Beta/prod release timeline depends on testing feedback.
Show HN: A local secrets manager with easy backup
10 months ago
- yacs is a command-line tool for securely storing, managing, and retrieving secrets locally in an encrypted JSON file.
- It uses AES encryption with a master password, employing PBKDF2 for key derivation and a unique salt for enhanced security.
- Features include initialization with a master password and hint, adding and retrieving secrets, viewing keys and descriptions, and resetting the credential store.
- The tool ensures security by verifying the master password after initialization and using a randomly generated IV for each encryption.
- Installation is via pip with the command 'pip install yacs-cli', and it supports commands like init, put, get, view, and reset.
- The project is open-source under the MIT License, welcoming contributions through issues or pull requests.
Possible End to End to End Encryption: Come Help
10 months ago
- The European Commission is seeking experts to advise on 'effective and lawful access to data for law enforcement'.
- The initiative is led by DG HOME and DG CNECT, with DG JUST not in the lead, raising concerns.
- Experts from various fields, including cybersecurity, telecommunications, and justice, are encouraged to apply by September 1st.
- The expert group will remain active for a year, with no payment for participation but travel cost reimbursement.
- The author, while not applying, offers to assist potential applicants with expertise and advice.
Show HN: DIAC – Open-Source Quantum-Resistant Cryptosystem
10 months ago
- Dimensional Imaginary Asymmetric Cryptography (DIAC) is a new public-key encryption system.
- DIAC uses multidimensional, high-precision complex keyspaces and a one-way modular trapdoor function.
- It offers ultra-high entropy, modular speed, and true quantum resistance.
- DIAC surpasses classical systems like RSA and ECC in security and efficiency.
- The system is immune to brute-force and quantum attacks.
- Includes LaTeX article, Jupyter notebook implementation, and benchmark data.
Jurisdiction Is Nearly Irrelevant to the Security of Encrypted Messaging Apps
10 months ago
- Properly built cryptography means the hosting country of ciphertext doesn't matter for security.
- Key management, transparency logs (Key Transparency, Binary Transparency), and reproducible builds are essential for secure messaging apps.
- End-to-end encryption protocols like MLS and Signal Protocol must be implemented without tolerating plaintext transmission.
- Independent third-party monitors are crucial for verifying transparency logs and ensuring security.
- Jurisdiction is a minor concern if cryptography is correctly implemented, as metadata is the only accessible data.
- Government backdoor attempts can be detected through binary transparency and reproducible builds.
- Signal is close to being a proper implementation but lacks key transparency and third-party build verification.
- Data sovereignty is a preference, not a cryptographic security consideration.
Parliament in Austria has approved tracking messages in chat applications
10 months ago
- Austrian Parliament passed a law allowing security forces to monitor encrypted communications in apps like WhatsApp, Messenger, and Signal.
- Monitoring is limited to cases involving suspected terrorism, unconstitutional activities, or espionage.
- Permission for monitoring is initially granted for three months, with possible extensions, and requires multiple approvals.
- Opposition parties, including FPÖ and Greens, criticized the law, calling it 'citizens’ spying software' and expressing concerns about misuse.
- The Greens are considering appealing to the Constitutional Court, doubting the technical feasibility of targeted monitoring.
- Austrian Interior Minister Gerhard Karner defended the law, stating it enhances security and adapts to modern communication methods used by terrorists.
White Noise – secure and private messenger
10 months ago
- White Noise is a secure and private messenger with end-to-end encryption, forward secrecy, and post-compromise security.
- It allows identity freedom—users can communicate anonymously, pseudonymously, or with their real name.
- Built on open standards like Nostr and Messaging Layer Security (MLS), it supports decentralization and platform portability.
- The network is distributed and censorship-resistant, with thousands of independent nodes worldwide.
- Engineered for speed and scalability, it handles messages from direct chats to large groups efficiently.
- White Noise is a non-profit, community-driven project, free from corporate or government influence.
A Technical Look at Iran's Internet Shutdowns
10 months ago
- Iran's National Information Network (NIN) is a state-controlled intranet designed to function independently of the global internet.
- The NIN enables selective blackouts, allowing domestic services to run while blocking international platforms.
- Iran's Great Firewall (IRGFW) filters, blocks, and surveils traffic, but has vulnerabilities due to outdated IP records.
- Pingtunnel uses ICMP packets to bypass censorship, allowing slow but functional communication.
- Starlink terminals bypass local ISP infrastructure, with users sharing connections via WireGuard VPN tunnels.
- Self-hosted encrypted services like Matrix Synapse can operate within the NIN, providing secure local communication.
Encrypting Files with Passkeys and Age
10 months ago
- Typage is a TypeScript implementation of the age file encryption format, supporting Node.js, Deno, Bun, and browsers.
- Passkeys are synced, discoverable WebAuthn credentials, offering phishing-resistant authentication.
- WebAuthn PRF extension allows symmetric encryption by treating PRF output as a key, requiring user verification.
- Typage 0.2.3 introduces passkey support for file encryption, requiring less than 300 lines of code.
- Passkeys can be stored in platform authenticators, password managers, or hardware FIDO2 tokens like YubiKeys.
- The fido2prf age format encrypts file keys using PRF outputs, ensuring per-file hardware binding and unlinkability.
- Typage allows encryption and decryption using passkeys with simple API calls to WebAuthnRecipient and WebAuthnIdentity.
- Security keys can be used with Typage via the age-plugin-fido2prf CLI plugin, enabling hardware token support.
- The identity string encodes credential details for use in security key flows, enhancing encryption security.
Borg - Deduplicating Archiver with Compression and Encryption
9 months ago
- BorgBackup is a deduplicating archiver with compression and encryption.
- It provides space-efficient storage of backups.
- Offers secure, authenticated encryption.
- Supports multiple compression methods: lz4, zstd, zlib, lzma, or none.
- Backups can be mounted with FUSE.
- Easy installation on various platforms including Linux, macOS, BSD.
- Free software under the BSD license.
- Supported by a large and active open-source community.
Switzerland plans surveillance worse than US
9 months ago
- Switzerland is proposing an update to its surveillance law (VÜPF) that would significantly expand state surveillance powers, surpassing even those of the USA.
- The law would require Swiss email and VPN providers with just 5,000 users to log IP addresses and retain data for six months, a practice illegal in Germany for email providers.
- Anonymous usage would be rendered impossible as ID or driver’s license and possibly a phone number would be required for service registration.
- Providers must be able to decrypt user data upon request, except for end-to-end encrypted messages between users.
- The law is being introduced by the Swiss government without parliamentary input, bypassing Switzerland’s direct democracy principles.
- The update targets smaller providers and anonymous services, including encrypted chat and email providers like Threema and Proton Mail, as well as VPNs.
- Proton Mail is moving its servers out of Switzerland due to the proposed mass surveillance measures, citing legal uncertainty.
- Critics argue the law undermines privacy, secure communication, and Switzerland’s reputation as a hub for secure online services.
- Legal experts highlight potential conflicts with the Data Protection Act and constitutional privacy rights.
- The law represents a broader trend of attempts to undermine encryption, with opposition from privacy advocates and companies like Tuta Mail.
Quantum Scientists Have Built a New Math of Cryptography
9 months ago
- Quantum cryptography offers a new approach to encryption by leveraging quantum physics, potentially securing a wider range of tasks even if classical cryptographic problems become easily solvable.
- A 2021 paper introduced a quantum-based problem that could replace classical one-way functions as the foundation for cryptography, though initially relying on unrealistic assumptions like hypothetical oracles.
- Cryptographers Dakshita Khurana and Kabir Tomer developed 'one-way puzzles,' a quantum-classical hybrid building block, enabling cryptographic protocols without needing easily breakable classical locks.
- The matrix permanent problem, known for its difficulty and lack of easy verification, is proposed as a new bedrock for quantum cryptography, linking it to quantum computational advantages.
- Despite theoretical advancements, practical implementation of quantum cryptography awaits further development in quantum computing technology, with current methods still under scrutiny for security.
systemd-homed
9 months ago
- systemd-homed is a service for portable human-user accounts, storing all user info in a single encrypted storage medium.
- It enables home directory portability and security by managing encryption on login and locking on system suspend.
- Installation involves enabling systemd-homed.service and requires pambase package version 20200721.1-2 or later.
- homectl is the main utility for managing users, home directories, and .identity files, supporting various storage mechanisms like LUKS, fscrypt, and directory.
- User records can be inspected and modified using homectl, with options to set UID, shell, groups, and more.
- Tips include setting default mount options for LUKS, enabling SSH remote unlocking, and handling home directory issues like dirty states.
- Troubleshooting covers issues like Plasma logout problems, umask settings, and recovery from unexpected shutdowns.
Meejah/shwim: Peer-to-peer terminal sharing
9 months ago
- Shell With Me (shwim) allows a host to share their terminal with a guest peer on another computer.
- It combines Magic Wormhole's cryptography and tty-share's terminal-sharing for secure, end-to-end encrypted, peer-to-peer terminal sharing.
- Install using 'pip install shwim' and run 'shwim --help' for instructions.
- Host runs 'shwim' to generate a magic code; guest runs 'shwim <magic-code>' to connect.
- Both host and guest run tty-share as subprocesses for secure networking via Magic Wormhole.
- All terminal I/O is forwarded to tty-share, supporting features like curses.
- Connection is temporary; no long-term credentials or network settings are preserved after exit.
I'm Archiving Picocrypt
9 months ago
- A developer left a final parting message for his archived open-source file encryption software.
- The message is addressed to 'Gemini', asking for help in analyzing and understanding it.
- The message includes a list of usernames or identifiers: '1z5q, mshedsilegx, BigPanda97, ryand56, Lg42tv and 3 more'.
Show HN: Stasher – Burn-after-read secrets from the CLI, no server, no trust
9 months ago
- Stasher is a command-line tool for secure, ephemeral secret sharing.
- It is designed for people who are busy, paranoid, or both.
- Stasher uses zero-knowledge encryption (AES-256-GCM) done locally.
- Secrets are burn-after-read, meaning they are deleted after one use.
- The tool is CLI-first, allowing for piping, scripting, and automation.
- No setup is required; it can be run with npx.
- Secrets have a 10-minute expiry with proactive and reactive cleanup.
- Stasher provides full supply chain transparency with signed releases and attestations.
- It supports sharing secrets via strings, files, or stdin.
- Stasher is powered by Cloudflare Edge for security.
- The backend is built with Cloudflare Workers and Durable Objects.
- Stasher started as a personal project and evolved into a zero-trust tool.
Encryption made for police and military radios may be easily cracked
9 months ago
- Researchers discovered a backdoor in an encryption algorithm used in radios for critical infrastructure, police, and military, making communications vulnerable.
- An end-to-end encryption solution recommended to fix the issue was found to have similar vulnerabilities, reducing key strength from 128-bit to 56-bit.
- The flawed encryption is primarily used by law enforcement, special forces, and intelligence agencies needing high security.
- The vulnerabilities were found in TETRA-based radio systems, widely used globally except in the US, affecting many countries' security services.
- ETSI and TCCA, responsible for the standards, claim the end-to-end encryption's key strength varies based on export controls and government requirements.
- Researchers found that the weakening of encryption keys is not transparently communicated to end-users, raising concerns about security awareness.
- The vulnerabilities allow eavesdropping, message injection, and replay attacks, impacting all users of the TCCA's end-to-end encryption scheme.
Improving Geographical Resilience for Distributed Open Source Teams with Freon
9 months ago
- Jurisdiction where ciphertext is stored is irrelevant if end-to-end encryption is securely implemented.
- Jurisdiction matters for software development due to potential government backdoors like the U.S.A. P.A.T.R.I.O.T. Act and CLOUD Act.
- Open source mitigations include public software releases, reproducible builds, and digital signatures for supply-chain security.
- Key transparency is crucial for end-to-end encrypted messaging apps to prevent key substitution attacks.
- Threshold signatures, like FROST, can remove single points of failure in software signing by distributing the signing key.
- FREON is a new tool implementing FROST for Ed25519 signatures, aimed at securing Git releases and other protocols.
- Freon includes client and coordinator software for decentralized, secure signing ceremonies, with future enhancements planned.

first prev2next

About|Login

#encryption

OpenADP, needs volunteers to help prevent mass secret surveillance

FOKS – The Federated Open Key Service

Public Signal Backups Testing

Show HN: A local secrets manager with easy backup

Possible End to End to End Encryption: Come Help

Show HN: DIAC – Open-Source Quantum-Resistant Cryptosystem

Jurisdiction Is Nearly Irrelevant to the Security of Encrypted Messaging Apps

Parliament in Austria has approved tracking messages in chat applications

White Noise – secure and private messenger

A Technical Look at Iran's Internet Shutdowns

Encrypting Files with Passkeys and Age

Borg - Deduplicating Archiver with Compression and Encryption

Switzerland plans surveillance worse than US

Quantum Scientists Have Built a New Math of Cryptography

systemd-homed

Meejah/shwim: Peer-to-peer terminal sharing

I'm Archiving Picocrypt

Show HN: Stasher – Burn-after-read secrets from the CLI, no server, no trust

Encryption made for police and military radios may be easily cracked

Improving Geographical Resilience for Distributed Open Source Teams with Freon