mox

joined 7 months ago
[–] [email protected] 39 points 1 day ago* (last edited 17 hours ago) (4 children)

Discord’s audio and video end-to-end encryption (“E2EE A/V” or “E2EE” for short)

That last bit is a little concerning. E2EE is widely understood to mean full end-to-end encryption of communications, not selective encryption of just the audio/video bits while passing the text around in the clear. If Discord starts writing "E2EE" for short when describing their partial solution, it is likely to mislead people into thinking their text chats are protected, or thinking that Discord is comparable to real E2EE systems. They aren't, and it isn't.

We want an E2EE A/V protocol that is publicly auditable

Their use of the word "auditable" here is also concerning. What does it mean for a protocol to be auditable? Sure, it's nice that they're publishing their design, but that doesn't allow independent audit of the implementation that actually runs on their servers and (importantly) people's devices. Without publicly auditable code that can be independently, built, run, and used instead of the binaries they provide, there's no practical way to know that it matches the design that was reviewed. And even if code is made available, without a way to verify that the code being run is the code that was inspected, any claim giving the impression that the system was audited is misleading at best.

During the rollout phase, a single non-supporting member being present forces the call to transport-only encryption. The call will automatically “upgrade” to E2EE if that member disconnects.

This sort of thing has historically been ripe for abuse. (See also: downgrade attack.) I hope they are very careful about how they implement it.

The protocol uses Messaging Layer Security (MLS) for group key exchange

Interesting. This makes me wonder if their motivation might be eventual compliance with the European Digital Markets Act. If that is the case, perhaps they also have a plan in the works for protecting text chats?

My early impression, based on what they wrote:

This won't fix Discord's major fundamental flaws. However, if their E2EE A/V design holds up to scrutiny, and if they were to fix their problematic language and provide truly auditable client code, the protection offered for audio & video could at least reduce Discord users' exposure to unwanted harvesting of voice & face samples. A step in the right direction, and a timely one, given that biometric data collection and AI impersonation are on the rise.

[–] [email protected] 16 points 1 day ago* (last edited 1 day ago)

@[email protected] was created ~37 minutes ago.

Their only post violates rule 2, and probably violates lemmy.world rule 8 (misinformation).

Somebody please show them to the door.

[–] [email protected] 17 points 3 days ago* (last edited 3 days ago)

also any inputs are probably scraped

ftfy

Let's hope it's the bad outputs that are scrapped. <3

[–] [email protected] 2 points 4 days ago (1 children)

many results say to install custom ROMs which I can’t since its a US model and the bootloader is locked.

Are you sure it can't be unlocked?

https://xdaforums.com/t/guide-to-root-galaxy-s22-plus-b-e-n-0-unlock-bootloader-and-flash-official-firmware-noob-friendly.4404351/

Many phones that don't officially support unlocking can be exploited to do so anyway. Some will lose relatively minor functionality in the process (camera enhancements were lost on mine, but the camera still works fine) but the tradeoff is often worth it.

[–] [email protected] 9 points 4 days ago* (last edited 4 days ago)

And it was composed by Quincy Jones, who has earned a small mountain of awards for his music over the years. Not many TV shows get a theme as good as that one.

Here's the studio version:

https://www.youtube.com/watch?v=1-wZUgvSlOo

[–] [email protected] 11 points 5 days ago* (last edited 5 days ago) (6 children)

Is it true that Telegram doesn't encrypt group chats at all? Maybe that would get their attention?

My biggest criticism of Telegram (but not the only one) is that they use homebrew crypto. Of course, I don't know if your family would understand why that's bad.

[–] [email protected] 8 points 6 days ago* (last edited 5 days ago)

That number is a single manufacturer's performance target. It is not a guarantee of results. You might be able to get Intel to replace an SSD if it corrupts data in under 52 weeks (assuming you notice it) but your data will still be gone.

Hardware performance can and does vary by manufacturer, model, and production run. Even the nominally identical cores within a single CPU have slightly different operating limits. YMMV.

Note also: the 52 week target you quoted is halved for every 5° rise in temperature.

[–] [email protected] 89 points 6 days ago* (last edited 6 days ago) (8 children)

I explained that they ought to be recipes to new media every N number of years or risk deteriorating or becoming unreadable

This is important, and for some media, it should be more often than that.

People forget that flash memory uses electrical charge to store data. It's not durable. If left unpowered for too long, that data will get corrupted. A failure might not even be visible without examining every bit of every file.

Keep backups. Include recovery data (e.g. PAR2). Store them on multiple media. Keep them well-maintained (e.g. give flash drives power). Mind their environment. Copy them to new storage devices before the old ones become obsolete.

It's funny that with all our technology, paper is still the most durable storage medium (under normal conditions) that doesn't cost an arm and a leg.

[–] [email protected] 15 points 6 days ago

Have they not heard of the TS100 or the Pinecil?

Of course they have.

An iFixit co-founder has been responding to questions over on Hacker News:

https://news.ycombinator.com/item?id=41521919

[–] [email protected] 8 points 1 week ago* (last edited 1 week ago) (2 children)

An SD card lasts for years, and the amount of plastic in one is negligible. It’s just not an issue.

Hark! The ghosts of countless generations of short-sighted polluters cry out in complacent, rationalizing unison!

It's not about expecting one model of memory card to save the Earth. It's about moving away from needless production of toxic materials, everywhere.

And if you don't care, nobody's going to force you to read The Lorax, but please don't go around shitting on people's appreciation for even the small things.

52
submitted 1 week ago* (last edited 1 week ago) by [email protected] to c/[email protected]
 

It's nice to see they have transcripts, too.

Direct link to the NSA site: https://www.nsa.gov/Podcast/

Article archive: https://archive.today/CcH52

 

cross-posted from: https://lemm.ee/post/36566249

The use of selfies to verify identity online is an emerging trend in some parts of the world since the pandemic forced more business to go digital. Some banks – and even governments – have begun requiring live images over Zoom or similar in order to participate in the modern economy. The question must be asked, though: is it cyber smart?

Just last Monday the Southeast Asian nation of Vietnam began requiring face scans on phone banking apps as proof of identity for all digital transactions of around $400 and above.

The nation's residents are not able to opt out of the banking rules, despite Vietnam regularly finding itself ranked poorly when it comes to internet privacy or cyber security.

Local media has weighed in to suggest that selfies will not improve security. And just days into the new regime, some apps have already been called out for accepting still photos instead of a live image of the individual.

view more: next ›