Readit Newsarkadiyt commented on Show HN: Real-time privacy protection for smart glasses github.com/PrivacyIsAllYo... · Posted by u/tash_2s
I don't need something to protect the privacy of others from me, I need something to protect my privacy from others. The majority of people who use smart glasses are not going to be using this - where is the product that will protect me from them?
arkadiyt commented on Why I no longer have an old-school cert on my HTTPS site rachelbythebay.com/w/2025... · Posted by u/mcbain
I thought FS only protected other sessions from leak of your current session key. How does it protect against passive recording of the session and later attacking of the recorded session in the future?
If using a non-FS key exchange (like RSA) then the value that the session key is derived from (the pre-master secret) is sent over the wire encrypted using the server's public key. If that session is recorded and in the future the server's private key is obtained, it can be used to decrypt the pre-master secret, derive the session key, and decrypt the entire session.
If on the other hand you use a FS key exchange (like ECDHE), and the session is recorded, and the server's private key is obtained, the session key cannot be recovered (that's a property of ECDHE or any forward-secure key exchange), and none of the traffic is decryptable.
arkadiyt commented on Why I no longer have an old-school cert on my HTTPS site rachelbythebay.com/w/2025... · Posted by u/mcbain
Amateur question: does a 4096 not give you more security against passive capture and future decrypting? Or is the intermediate also a factor in such an async attack?
> does a 4096 not give you more security against passive capture and future decrypting?
If the server was using a key exchange that did not support forward secrecy then yes. But:
% echo | openssl s_client -connect rachelbythebay.com:443 2>/dev/null | grep Cipher
New, TLSv1.2, Cipher is ECDHE-RSA-AES256-GCM-SHA384
Cipher : ECDHE-RSA-AES256-GCM-SHA384
arkadiyt commented on Why I no longer have an old-school cert on my HTTPS site rachelbythebay.com/w/2025... · Posted by u/mcbain
> Make an RSA key of 4096 bits. Call it your personal key.
This is bad advice - making a 4096 bit key slows down visitors of your website and only gives you 2048 bits of security (if someone can break a 2048 bit RSA key they'll break the LetsEncrypt intermediate cert and can MITM your site). You should use a 2048 bit leaf certificate here
arkadiyt commented on Ask HN: Former employees' RSUs at risk after startup's IPO · Posted by u/jameskuang
Can someone just name the company, cause there is enfough information here that it’s not hard to figure out.
185 days before 3/15/2025 is 9/11/2024. There were these IPOs around that time (all Nasdaq) [1]:
- 9/10: TDTH
- 9/10: XCH
- 9/12: GLXG
- 9/12: FVN