#deltachat is a minority messenger today and that's just fine for now. Changes often come from the precarious fringe which has to make ends meet, under hostile circumstances. Our approaches are aiming to provide working software that does its damn job. No unable to decrypt, no going for VC/Blockchain money, no bending the knee and no endorsing of corporate platforms. The #chatmail server network implements #interoperable #cryptography , does away with shady spam lists, catering for #Gmail etc
No coins, no chains, no big machinery but plain, efficient and scalable decentralization, leveraging the largest open internet messaging network ever created by humans ... made safe, fast and resource efficient with #chatmail servers using strong and audited #interoperable #cryptography. It just works (tm) in many places where Signal and WhatsApp fail today. It's time to reclaim "decentralization" from techbros, insist on real-life #resilience and trust this cute figure from @Xeniax :)
Use this great opportunity to focus on high quality of produced software and grow in operating system security. The Red Hat Quality Engineering (QE) Team is looking for an Automation Engineer to join us in the Czech Republic.
I hope to hear from @Tutanota very soon. Lack of key verification is a major flaw in the technical design of the platform, allowing a malicious Tuta server to read end-to-end encrypted exchanges (both emails and shared calendars).
I somehow just learned about the IETF's "Privacy Pass" working group, along with Google and Apple's respective implementations ("Private State Tokens", "Private Access Tokens"), and I'm so damn tired of DRM being the answer to everything.
Mozilla wrote a blog post in December of 2023 about why they decided not to implement it:
The arrest of #Telegram's founder Pavel #Durov sets a dangerous precedent for what kind of action can be taken against supporters of #privacy & #cryptography.
There are lots of messaging apps similar to WhatsApp. Here's a review of the best secure alternatives: Signal, Threema, Telegram, Element, Wire, SimpleX, Session, and more.
#cryptography news: rpgp, the pure Rust #OpenPGP encryption engine used in all #deltachat apps, got quite some love lately, including a revamp of the main entry point for developers: github.com/rpgp/rpgp . You may regard rpgp as an extension of the #rustcrypto effort where a lot of the base code lives and is co-maintained by the wonderful diginifiedquire who also just landed a long awaited sha1-collision detector -- as one of the few people officially allowed to write crypto code :)
Do you like security? Do you like privacy? Cryptography? Do you like working for a public benefit non-profit instead of an investor-beholden corporation?
Let's Encrypt is hiring for someone to join our SRE team and help run the largest Certificate Authority in the world! Come work with me and some of the most wonderful folks in tech, to make the web a better place.
Posted: September 29, 2022
Start Date: January 2023
Position Status: Open
Location: Remote within US
Compensation: $140k USD, 100% 401k Match, Excellent Insurance We’re making HTTPS easier for developers to use, we’re doing it at scale, and we need y…
Small Web sites will require JavaScript to sign in.
Why?
To protect your privacy.
We use public-key authentication (which I’m implementing as we speak) so your secret is never stored on the server and you only enter it in places you own and control.
(I can already see some folks up in arms about this because JavaScript Bad™ so I just checked in the initial copy for the page that gets displayed if JavaScript is off.)
Soatok's Proposal for End-to-End Encryption in Mastodon - GitHub - soatok/mastodon-e2ee-specification: Soatok's Proposal for End-to-End Encryption in Mastodon
To learn more about #MLS and why this protocol exists in the first place when we already have Signal's, here is a great podcast on the topic: cryptography.fm/7.
I'd like to find a community of other people in #tech, maybe people who are interested in talking about things like #cloud alternatives, #cryptography, or #softwaredev processes (like #agile, I guess), #programming. I haven't found too much of that on here. Point me at the good discussions and knowledge sharing, if you know where it is!
Look, software isn't everything, and I'm sure I'll get into some other stuff on here, but the above is what I haven't found yet. #introductions #introduction
![Message posted on the GitHub issue titled "Manual key verification":
"This issue has been opened for more than 6 years now, with no clear roadmap or even real consideration from the Tuta team. I have to say, I am disappointed.
You keep saying that "[...] Tuta [is] the most secure email service on the market.", but without key verification, a malicious Tuta server can read the end-to-end encrypted emails and shared calendars exchanged on the platform as there is no way to verify the recipients' public key. As explained by @llebout, "all users of Tutanota must trust Tutanota to not provide forged keys and perform an MITM attack". This is a significant flaw in the technical design of the platform, and it does not seem to bother you.
In #198, it can be read that:
> We are aware of the issues with verification, new protocol will support verification, the work is underway
However, your post-quantum implementation has now landed but still no word on the key verification issue.
Could you please stand by what you have said from day 1, that you prioritise security and privacy, and establish a clear roadmap of the work already undertaken or to be done to fix the situation?
Thank you"](https://fedi.ml/photo/preview/640/595249 "Message posted on the GitHub issue titled \"Manual key verification\":
\"This issue has been opened for more than 6 years now, with no clear roadmap or even real consideration from the Tuta team. I have to say, I am disappointed.
You keep saying that \"[...] Tuta [is] the most secure email service on the market.\", but without key verification, a malicious Tuta server can read the end-to-end encrypted emails and shared calendars exchanged on the platform as there is no way to verify the recipients' public key. As explained by @llebout, \"all users of Tutanota must trust Tutanota to not provide forged keys and perform an MITM attack\". This is a significant flaw in the technical design of the platform, and it does not seem to bother you.
In #198, it can be read that:
> We are aware of the issues with verification, new protocol will support verification, the work is underway
However, your post-quantum implementation has now landed but still no word on the key verification issue.
Could you please stand by what you have said from day 1, that you prioritise security and privacy, and establish a clear roadmap of the work already undertaken or to be done to fix the situation?
Thank you\"")
