Search
Items tagged with: Cryptography
I hope to hear from @Tutanota very soon. Lack of key verification is a major flaw in the technical design of the platform, allowing a malicious Tuta server to read end-to-end encrypted exchanges (both emails and shared calendars).
github.com/tutao/tutanota/issu…
The issue has been opened 6 years ago.
#Security #Privacy #Crypto #Cryptography #Email #FOSS
![Message posted on the GitHub issue titled "Manual key verification":
"This issue has been opened for more than 6 years now, with no clear roadmap or even real consideration from the Tuta team. I have to say, I am disappointed.
You keep saying that "[...] Tuta [is] the most secure email service on the market.", but without key verification, a malicious Tuta server can read the end-to-end encrypted emails and shared calendars exchanged on the platform as there is no way to verify the recipients' public key. As explained by @llebout, "all users of Tutanota must trust Tutanota to not provide forged keys and perform an MITM attack". This is a significant flaw in the technical design of the platform, and it does not seem to bother you.
In #198, it can be read that:
> We are aware of the issues with verification, new protocol will support verification, the work is underway
However, your post-quantum implementation has now landed but still no word on the key verification issue.
Could you please stand by what you have said from day 1, that you prioritise security and privacy, and establish a clear roadmap of the work already undertaken or to be done to fix the situation?
Thank you"](https://fedi.ml/photo/preview/640/595249 "Message posted on the GitHub issue titled \"Manual key verification\":
\"This issue has been opened for more than 6 years now, with no clear roadmap or even real consideration from the Tuta team. I have to say, I am disappointed.
You keep saying that \"[...] Tuta [is] the most secure email service on the market.\", but without key verification, a malicious Tuta server can read the end-to-end encrypted emails and shared calendars exchanged on the platform as there is no way to verify the recipients' public key. As explained by @llebout, \"all users of Tutanota must trust Tutanota to not provide forged keys and perform an MITM attack\". This is a significant flaw in the technical design of the platform, and it does not seem to bother you.
In #198, it can be read that:
> We are aware of the issues with verification, new protocol will support verification, the work is underway
However, your post-quantum implementation has now landed but still no word on the key verification issue.
Could you please stand by what you have said from day 1, that you prioritise security and privacy, and establish a clear roadmap of the work already undertaken or to be done to fix the situation?
Thank you\"")
rPGP is an #OpenPGP implementation in pure #Rust (crates.io/crates/pgp).
It serves as the end-to-end encryption engine for Delta Chat:
@delta, a secure decentralized messager for all major platforms (and then some).
rPGP implements all generations of the OpenPGP standard, up to and including the new RFC 9580.
I somehow just learned about the IETF's "Privacy Pass" working group, along with Google and Apple's respective implementations ("Private State Tokens", "Private Access Tokens"), and I'm so damn tired of DRM being the answer to everything.
Mozilla wrote a blog post in December of 2023 about why they decided not to implement it:
blog.mozilla.org/en/privacy-se…
...and the IETF has a page to track the working group's drafts:
datatracker.ietf.org/wg/privac…
#IETF #DRM #cryptography #privacy
The arrest of #Telegram's founder Pavel #Durov sets a dangerous precedent for what kind of action can be taken against supporters of #privacy & #cryptography.
Don't settle for anything less than E2E #encryption! We've created a list of the top encrypted messaging apps to help!
👉 tuta.com/blog/best-whatsapp-al…
Best WhatsApp Alternatives For 2024 | Time To Go Private! | Tuta
There are lots of messaging apps similar to WhatsApp. Here's a review of the best secure alternatives: Signal, Threema, Telegram, Element, Wire, SimpleX, Session, and more.Tuta
GitHub - rpgp/rpgp: OpenPGP implemented in pure Rust, permissively licensed
OpenPGP implemented in pure Rust, permissively licensed - rpgp/rpgpGitHub
No more rocket science, I'm moving to Post-Quantum encryption any day now...
tuta.com/blog/post-quantum-cry…
@Tutanota
#infosec #cryptography
Post Quantum Cryptography: Why We Need Resistant Encryption NOW.
Quantum-resistant or post-quantum cryptography is our best bet against attacks from upcoming quantum computers to increase security and privacy.Tutanota
After #AI, quantum computers will be next big thing in tech.
And they'll be able to break currently used email #encryption.
Plus, the NSA already uses "harvest now, decrypt later" strategies.
That's why we at Tuta are working on post-quantum #cryptography. 🔒💪
Read everything you need to know about this amazing journey:
tuta.com/blog/post-quantum-cry…
Post Quantum Cryptography: Why We Need Resistant Encryption NOW.
Quantum-resistant or post-quantum cryptography is our best bet against attacks from upcoming quantum computers to increase security and privacy.Tutanota
In an era of quantum computing "arms race", it is time to transition to quantum-safe systems.
Tutanota is well ahead of the race: We already have a working prototype with post-quantum secure encryption. Stay tuned for future updates! 🤓💪
The nontechnical introduction to #Keyoxide and online identity verification using #cryptography is now online!
It was presented yesterday at #fosdem!
Do you like security? Do you like privacy? Cryptography? Do you like working for a public benefit non-profit instead of an investor-beholden corporation?
Let's Encrypt is hiring for someone to join our SRE team and help run the largest Certificate Authority in the world! Come work with me and some of the most wonderful folks in tech, to make the web a better place.
abetterinternet.org/careers/le…
#jobs #sre #webPKI #security #privacy #cryptography
Let's Encrypt Software Engineer (SRE)
Posted: September 29, 2022 Start Date: January 2023 Position Status: Open Location: Remote within US Compensation: $140k USD, 100% 401k Match, Excellent Insurance We’re making HTTPS easier for developers to use, we’re doing it at scale, and we need y…Internet Security Research Group
Small Web sites will require JavaScript to sign in.
Why?
To protect your privacy.
We use public-key authentication (which I’m implementing as we speak) so your secret is never stored on the server and you only enter it in places you own and control.
(I can already see some folks up in arms about this because JavaScript Bad™ so I just checked in the initial copy for the page that gets displayed if JavaScript is off.)
#SmallWeb #Kitten #SmallTech #JavaScript #cryptography #authentication
Towards End-to-End Encryption for Direct Messages in the #Fediverse
soatok.blog/2022/11/22/towards…
GitHub proposal here:
github.com/soatok/mastodon-e2e…
#mastodon #crypto #cryptography
GitHub - soatok/mastodon-e2ee-specification: Soatok's Proposal for End-to-End Encryption in Mastodon
Soatok's Proposal for End-to-End Encryption in Mastodon - GitHub - soatok/mastodon-e2ee-specification: Soatok's Proposal for End-to-End Encryption in MastodonGitHub
To learn more about #MLS and why this protocol exists in the first place when we already have Signal's, here is a great podcast on the topic: cryptography.fm/7.
#Privacy #Security #Crytology #Cryptography #InfoSec
Episode 7: Scaling Up Secure Messaging to Large Groups With MLS!
Raphael Robert from Wire talks about how MLS wants to scale secure messaging to groups with hundreds or even thousands of participants.Cryptography FM
I'd like to find a community of other people in #tech, maybe people who are interested in talking about things like #cloud alternatives, #cryptography, or #softwaredev processes (like #agile, I guess), #programming. I haven't found too much of that on here. Point me at the good discussions and knowledge sharing, if you know where it is!
Look, software isn't everything, and I'm sure I'll get into some other stuff on here, but the above is what I haven't found yet.
#introductions #introduction