Want to read Slashdot from your mobile device? Point it at m.slashdot.org and keep reading!

 



Forgot your password?
typodupeerror
×

Comment Brainpool curves banned in TLS v1.3, bad security (Score 2) 28

Elliptic prime field curves including NIST and Dan Bernstein curves which have psuedo-mersenne primes with sparse representation are allowed in TLS v1.3.

However Brainpool curves with "random-like" non-sparse primes, are banned in TLS v1.3, even those these curves provide additional security protection against refined power analysis attacks including those that utilize zero values and zero coordinates. Note Brainpool curves are currently supported in TLS v1.2.

I am not against TLS v1.3 support for sparse prime curves, but it is bad for security not to also include an option to include the most popular non-sparse prime curves, when TLS v1.2 has it, especially in use cases where protection against physical attacks is required.

Comment Simply solution, block all 3rd party content (Score 4, Insightful) 409

When I visit "xyz.com", why should my browser need to connect to 1000 other websites just to get the homepage to load, any of which can contain potential browser exploits in order to inject malware.

First party sites can still host their own malware-free ads, and everything would be much faster, safer, and privacy preserving.

If advertisers require traffic evidence, they could still still opt to share their web logs, regularly timestamped by a trusted timestamp authority. It is still a better option that the current obstructive tracking we have now.

All it takes is for all of the non-Chrome browsers to make this a standard default.

Especially since Google would not allow this for Chrome, since it would impact their bottom line too much.

On a personally level, I am constantly complaining to my IT, that they are still using Google Analytics and other 3rd party trackers in our internal employee-only corporate website in our intranet.

Comment You don't need to be a millennial to keep your job (Score 0, Troll) 322

Just invite one of your helicopter parents to join you on your next employee performance review.

Trust me, your manager will consider you to be a defacto millennial.

Beyond that, keeping current with technology, including fads, also helps. Even if something current sucks in a particular context, you need to fully understand it, so that you can explain why it sucks in detail, and what alternatives would be better.

Comment Give Consumers The Option to Choose... (Score 3, Interesting) 83

... Security or Performance.

Not everyone is a gamer, video editor, etc.

Many people would gladly sacrifice 50% CPU performance, in exchange for more secure and stable processors.

But Intel and its OEMs are reluctant to even give us consumers the choice to obtain decent microcode security fixes that slow down our computers too much.

Intel already provides the NSA with the ME backdoor, so why won't they at least try harder to close the other security holes?

Comment new product: iWatchout (Score 1) 216

The next best thing from Apple: iWatchout.

It can be an iPhone app which uses the rear camera facing forward, or maybe some new ranging sensor (IR, sonar, laser) on a future iPhone, which alerts the user when they are about to walk into a hard surface (wall, door, ...).

Can be combined with Apple Maps and GPS, to also alert if there are nearby cliffs or other geographical hazards.

Comment why do we assume ... (Score 1) 238

That the products from one country has more back doors than those from another country.

Yes the hand of the state is deeply involved with corporate enterprises in China.

But that does not preclude things such as NSL (National Security Letters) and indirect influence via government purchases and tax breaks, which also pressure companies in other countries to install back doors or just implement weak/crippled security.

Look at the security mess with Intel ME and AMD PSP. Not to mention Microsoft Windows 10, and what they did to backdoor Skype.

Personally, I would be willing to pay double for computing products with reasonable performance and capabilities, that could be independently validated to have decent security and privacy, free of deliberate back doors.

Comment Re:Wealth distribution (Score 4, Insightful) 117

Oh please, not this again.

The minimum amount of money required to be successful at life varies per region, and must be sufficient to buy a modest 2-3 bedroom family home and car, while being able to raise a small family in modest comfort without incurring massive debt, while still having enough for retirement and unforeseen medical issues.

In the San Francisco Bay or Vancouver BC area, not even $100k per year is enough for this, due to massive home prices.

Comment Re:Hype or Something Else? (Score 4, Informative) 68

I have now seen multiple stories of crypto-currencies getting stolen or exchanges hacked. Then I read about how blockchain is supposed to be the end all, be all, of transaction security. Aren't these things connected at some level? What am I missing? How can something that is supposed to so hack resistance as blockchain allow for the common theft of crypto-currencies?

This is not a facetious question. It seems like the press (old man here, so using an old man term for everything in the public I read) is either breathlessly in awe of this stuff or telling me that someone just lost millions of dollars. I honestly don't know what to believe.

Crypto-currencies are secure at a mathematical level, regarding payment which is the transfer of funds from one wallet to another.

However payment involves compensation for the transfer of real-world assets, goods, and services, which is not covered (out-of-scope) of crypto-currencies, since regardless of how elegant the math is, there is simply no generic method to have any type of decentralized means of validating these real-world transfers. So we end up with a situation where "trusted" and "secure" 3rd party brokers are needed which act as crypto-currency intermediates between the buyer and seller, that can temporally hold the buyers purchase funds, in order to validate the transfer of real-world stuff from the seller to the buyer, before releasing the purchase funds to the seller.

Everything falls apart at "trusted" and "secure". Any 3rd party brokers will need to hold a large pool of crypto-currencies for purchases, and will need to have some type of online presence and infrastructure, which makes it a prime target for online attackers wanting to rob it. (In the same way that thieves target banks, because that is where the money is.) However time and time again we see that these 3rd party brokers are untrustworthy or incompetent, typically without even providing the minimum of security measures.

At the end of the day, this is where some government body (maybe from a different neutral country like Switzerland) will need to step up and implement some type of accreditation/certification of 3rd party brokers, that conform to the necessary regulation/protection and provide insurance protection, before crypto-currencies can really be trusted for transactions.

 

Comment I know where I'm buying my next camera from (Score 1) 110

China...

Geographic surveys can't be performed without permission from the government, and many digital cameras don't record GPS coordinates for geotagging, as they do in other countries, according to Fortune.

This sounds like a critical privacy feature, which is lacking in non-Chinese cameras.

Comment They are correct... (Score 2) 249

They did not need a court order to get Intel to install a backdoor into ME, AMD to install a backdoor into PSP, or Microsoft to install a backdoor into Windows 10, since they all did so quite willingly.

It is a shame consumers can no longer fully own their modern computers. And yet these government agencies refuse to cover any part of the cost of new computers which they have some control over.

Comment Re:Wow! (Score 2) 38

Actually this is quite news worthy.

Many folks were concerned that Qualcomm was focusing too much of their corporate resources on legal, instead of R&D.

It is always better to entice your customers with innovative and superior products, rather that piss them off with lawsuits.

Comment on a separate note (Score 5, Insightful) 299

The FBI can't beat confessions out of thousands and thousands of suspects, making it harder to get convictions from criminals hiding critical evidence in their encrypted (non-cleartext) brains.

Sorry, but some sacrifices are needed to keep democracies from becoming police states. Especially when it is always the police asking for more an more power over citizens they are supposed to protect.

Slashdot Top Deals

Remember, UNIX spelled backwards is XINU. -- Mt.

Working...