Dhole Moments, Soa Talks, and Other Bad Puns…
Your Cryptography Conspiracy Theory Is Wrong
This conversation plays out hundreds of times a day, but (thankfully) only a handful of those involve me: Conspiracy theories about the NSA and/or NIST are a dime a dozen these days. And, ever since the Snowden disclosures in 2013, I am politically primed to directionally agree with distrusting the US government wholesale. But most…
Touching Grass Isn’t Enough: The Furry Fandom’s Issues Are Structural
The problems with the furry fandom today are not as simple as,”Furries need to touch grass!” Unfortunately, whatever you’re seeing that makes you want to say such a thing is probably a structural problem with multiple compounding factors. I will elaborate. But first, for anyone who feels lost, I need to explain where we are…
The V8 JavaScript Runtime Undermined My Constant-Time JavaScript Library
Six years ago, I wrote a blog post titled Soatok’s Guide to Side-Channel Attacks in which I discussed the general topic of side-channels in cryptographic applications, and how to avoid them, with example code in PHP. I had called out that the algorithms discussed on the page cannot rule out compiler or runtime optimizations that…
Multi-Track Fursuiting?!
Last month, I attended both DEFCON and Megaplex. If you’re not familiar with either event, here’s all you need to know. DEFCON is a hacker convention with a substantial furry presence. Megaplex is a furry convention with a substantial hacker presence. If you’ve never attended either event, here’s a few essential things to remember: I…
The Long Tail of Work Left Until ActivityPub Has E2EE
Separate from my proposal for key transparency for the Fediverse (which I’ve certainly blogged about a lot), the W3C has been working on building out end-to-end encryption (E2EE) for ActivityPub. The two projects are mostly being developed independent of each other, though connecting the two should be straightforward. As I prepare to tie up the…
Soatok’s Informal Guide to Threat Models
After a long day of exhausting conversations about Hybrid Post-Quantum Cryptography, random jackasses trying to play gotcha with endpoint attacks against end-to-end encrypted messaging apps, and message board discussions in the wake of dumb politicians pushing more “age verification” bullshit on us all, it’s become abundantly clear to me that the phrase “threat model” is…
Hybrid Constructions: The Post-Quantum Safety Blanket
The funny thing about safety blankets is they can double as stage curtains for security theater. “When will a cryptography-relevant quantum computer exist?” is a question many technologists are pondering as they stare into crystal balls or entrails. Two people I admire recently made a public long bet about that question, with a $5000 donation…
Cryptography Engineering Has An Intrinsic Duty of Care
To understand my point, I need to first explain three different cryptography attack papers / blog posts. I promise this won’t be boring. Three Little Disclosures Misuse-Prone Ciphers For All In a blog post titled Carelessness versus craftsmanship in cryptography, cryptography analyst and Queer in Cryptography emcee Opal Wright delves into the misuse-prone and side-channel-riddled…
Cryptographic Issues in Matrix’s Rust Library Vodozemac
If you’re reading this after Matrix’s blog post, make sure you read the addendum to this one. Two years ago, I glanced at Matrix’s Olm library and immediately found several side-channel vulnerabilities. After dragging their feet for 90 days, they ended up not bothering to fix any of it. The Matrix.org security team also failed…
Is End-to-End Encryption Optional For Large Groups?
One of the recent topics in Messaging App Discourse is whether it makes sense to prioritize End-to-End Encryption (E2EE) when searching for an alternative to Discord. Who’s Saying “No”? I’m going to quote 0xabad1dea here, because she is awesome and explains my “opposition” position better than anyone else: So You Want To Write An Open…
Something went wrong. Please refresh the page and/or try again.
Follow My Blog
Get new content delivered directly to your inbox.