tabletopneedle (u/tabletopneedle)

tabletopneedle commented on iPhone Pocket apple.com/newsroom/2025/1... · Posted by u/soheilpro

bborud · a month ago

Objects have to earn the right to exist. We make so much stuff. Most of it unnecessary. Stuff that will soon be cluttering your home and then end up in a landfill.

This is not a product that deserves to exist. It is not made from quality materials ( Nylon (14%), Polyester (85%), Polyurethane (1%)). It is not innovative. It is questionable whether it solves its primary use case particularly well.

What makes this particularly objectionable is that it is from a design house that usually makes quality garments. And then they stoop to making this crap, slapping their designer label on it and then exploit ghastly people who don't know any better to waste tons of money on it.

This is pissing on Issey Miyake's grave.

tabletopneedle · a month ago

>It is questionable whether it solves its primary use case particularly well.

It solves the problem of "how do I flaunt the fact I carry an iPhone to everyone around me"

It's a conversation piece and way to flaunt your wealth and status by uncovering a iPhone 17 Pro Max S+ Duo XTX from it when asked.

tabletopneedle commented on Crown Sterling: Five years since TIME AI, five years of grifts and lie rationalwiki.org/wiki/Cro... · Posted by u/tabletopneedle

tabletopneedle · 2 years ago

Five years ago, today, the infosec community found itself wondering about Robert Edward Grant's Quasi-primes, and an ever expanding portfolio of grifts by his company, Crown Sterling. These included

* TIME AI, a completely bonkers, five-dimensional vaporware cipher with time-traveling keys,

* Black Hat 2019 crank presentation,

* Bogus RSA break claims, and later,

* Cryptographic protocol broken in just about all aspects,

* Cryptocurrency grifts, and as the newest addition,

* A browser-based messaging app.

This wiki-article documents and debunks pretty much all of it, in ridiculous detail and with more than 200 references.

tabletopneedle commented on RSA is a fragile cryptosystem blog.trailofbits.com/2019... · Posted by u/ingve

Hitton · 6 years ago

Well the article is certainly informative why not to self-implement RSA, but the conclusion to just use libsodium seems stupid. I don't really know cryptography, but I'm sure there are libraries that implement RSA correctly and could be easily used instead.

tabletopneedle · 6 years ago

Even if you were using a perfect implementation of RSA-OAEP, it would still be less secure than Diffie-Hellman over Curve25519 (called X25519) or Curve448 (called X448).

This is because RSA lacks forward secrecy: If the private RSA key is stolen, it can be used to retrospectively decrypt all past communication.

Also X448 provides the equivalent security of ~15000-bit RSA with a fraction of the key size, and key generation takes milliseconds instead of minutes.

tl;dr

For key exchange, use X25519 or X448.

For digital signatures, use Curve25519-based ed25519 signatures.

For authenticating communication, use authenticating encryption like ChaCha20-Poly1305 or Salsa20-Poly1305 or AES256-GCM.

For hash function, use Blake2 or SHA3-256 or SHA256.

tabletopneedle commented on RSA is a fragile cryptosystem blog.trailofbits.com/2019... · Posted by u/ingve

djsumdog · 6 years ago

This article doesn't mention openssl or ssh-keygen. Are the standard commands we see in most articles for creating keys via these two popular tools compromised in any way?

I never roll my own encryption, and most developers don't (unless they're just playing with stuff and learning how to understand it; and not use it in production). I stick to standard tools and libraries like Legion of the Bouncy Castle and pypi RSA.

I wish this article covered the way most developers interact with RSA libraries and showing us those specific problems.

tabletopneedle · 6 years ago

If you're on Python and you for some weird reason absolutely have to use RSA, make sure to use RSA-OAEP and the pyca/cryptography library: https://cryptography.io/en/latest/hazmat/primitives/asymmetr...

sybrenstuvel/python-rsa/ is PKCSv1.5 which like lvh said, is not secure.

RSA is fundamentally less secure than Diffie-Hellman as it lacks forward secrecy. So even a perfect implementation is still less secure.

tabletopneedle commented on RSA is a fragile cryptosystem blog.trailofbits.com/2019... · Posted by u/ingve

lvh · 6 years ago

Oh, hey, [2], that's me, glad you liked it.

FWIW: while I clearly subscribe to the notion of cryptographic education, I also thing that we should give people high-level recipes. Why are they the right ones? Yep, you gotta trust me. I'm fine with both of those existing ('tptacek and I co-authored our Cryptographic Right Answers doc from last year) because they have different audiences.

tabletopneedle · 6 years ago

Hey, just wanted to chime in Crypto101 was the ~first book I read on crypto and it was really well written. Kudos for your work.

tabletopneedle commented on RSA is a fragile cryptosystem blog.trailofbits.com/2019... · Posted by u/ingve

mikorym · 6 years ago

So, to be Devil's Advocate, does libsodium also provide an RSA implementation?

tabletopneedle · 6 years ago

There is no place to use RSA instead of Diffie-Hellman. DH provides forward secrecy, and the ECC variants are much faster and use shorter keys for equivalent security. They are harder to implement in a wrong way.

tabletopneedle commented on RSA is a fragile cryptosystem blog.trailofbits.com/2019... · Posted by u/ingve

mtgx · 6 years ago

This is a good guide for which one to choose:

https://safecurves.cr.yp.to

tabletopneedle · 6 years ago

Tl;dr

Curve25519 for 128-bit security, to use with 128/256-bit symmetric cipher.

X448 for 224-bit security to use with 256-bit symmetric cipher.

-

For symmetric ciphers choose any of the three below:

-ChaCha20-Poly1305

-Salsa20-Poly1305

-AES-GCM.

tabletopneedle commented on RSA is a fragile cryptosystem blog.trailofbits.com/2019... · Posted by u/ingve

tzs · 6 years ago

If I write something that uses libsodium, am I violating the near universal "don't roll your own crypto" admonishment, or does libsodium sufficiently hide all the scary dangerous cryptographic stuff so that mere mortals can safely use it?

tabletopneedle · 6 years ago

Yes. However, it never hurts to test your code.

Assuming you're a C-programmer, read the libsodium docs first. https://download.libsodium.org/doc/public-key_cryptography/s...

If you're using higher level language, use a library that provides bindings for it https://download.libsodium.org/doc/bindings_for_other_langua...

By using libsodium, you're not rolling your own crypto. Rolling your own crypto would mean

-trying to find new one way functions for public key crypto -trying to implement RSA from textbook -trying to implement RSA-OAEP from papers, RFCs, books etc.

Using a library is not anywhere near those. There are other ways to fail cryptography too, from not doing public key authentication, to storing private keys in insecure places.

So it's highly recommended you take time to read a book on the topic. The best modern book currently availalbe is https://www.amazon.com/Serious-Cryptography-Practical-Introd...

tabletopneedle commented on RSA is a fragile cryptosystem blog.trailofbits.com/2019... · Posted by u/ingve

peterwwillis · 6 years ago

> People aren't using shit crypto

From Why You Should Stop Using Telegram Right Now (2016) (https://gizmodo.com/why-you-should-stop-using-telegram-right...):

  According to interviews with leading encryption and security experts,
  Telegram has a wide range of security issues and doesn’t live up to its
  proclamations as a safe and secure messaging application. [...] 

  Telegram did what’s known as “rolling their own encryption,” which is
  widely considered to be a fatal flaw when developing encrypted messaging apps.

tabletopneedle · 6 years ago

Every time there's debate over Telegram's encryption the shill argument "it hasn't been broken in the wild now has it" pops up. This is fundamentally flawed thinking. The end-to-end-encryption is most likely reasonably safe (no glaring holes were pointed by experts except the IND-CCA problem). The real problem is Telegram uses their secret chats as a poor excuse for justifying the lack of E2EE for practically everything: "Just use secret chats if you need end-to-end encryption"

1. Telegram's E2EE is not on by default, therefore 99% of users don't use it.

2. Telegram's E2EE is not advertising authentication, therefore ~90% of the people using it don't check for MITM attacks, therefore majority of E2EE is useless against active attackers.

3. Telegram's E2EE does not work across devices, therefore majority people who use secret chats also use non-secret chats because desktop client don't support it.

4. 100% of Telegram's group conversations can be eavesdropped by the server, because Telegram doesn't have E2EE for group chats.

Complaining about possible cribs in how Telegram implemented the protocol from cryptographic primitives is an insignificant problem compared to the fact the entire protocol is fundamentally FUBAR, how it's so glaringly obvious you can't even fill out a CVE form.

If Signal had vulnerability where 100% of group conversations were not properly end-to-end encrypted, every newspaper in the world would publish something about it. However, with Telegram it has been spun as a "feature".

Another big problem is Telegram has been mentioned by hundreds of publications as "Secure apps like Signal, WhatsApp and Telegram".

To experts it's like hearing news spout "Great writers like Leo Tolstoy, Paulo Coelho, and Stephanie Meyer", or "Great bunker materials like reinforced concrete, steel, and MDF".

Repeatedly claimed, anyone would make mental associations between the three, but when you actually find out what they're about you can't believe your ears.