I blow hot air.

  • 5 Posts
  • 48 Comments
Joined 1 year ago
cake
Cake day: July 6th, 2023

help-circle






  • I’m more cynical, I think it’s just for clout and marketing. IA is widely known and used, so an attack is guaranteed to be noticed and generate news articles. They’re also known for having large robust infrastructure, but they aren’t large enough that an attack is impossible, so a successful attack is impressive yet still feasible. If someone can pull it off, it would make great marketing for their black market DDOS service and also grant huge bragging rights in certain communities.










  • If you’re worried about unauthorized access to the physical machine, you could always just do disk-level encryption instead or store the app’s data in something like a Veracrypt virtual disk. They’d still be able to access the data if they go through your OS/user, but wouldn’t pick anything up by accessing the drive directly.

    Nothing short of E2EE can truly stop someone from accessing your data if they have physical access to the server, but disk encryption would require a targeted attack to break, and no host is wasting their time targeting your meme server. I seriously doubt they’d access it even if you had no encryption at all, since if they get caught doing that they’d get in a heap of legal trouble and lose a ton of business.




  • From Signal’s blog footnotes:

    Usernames in Signal are protected using a custom Ristretto 25519 hashing algorithm and zero-knowledge proofs. Signal can’t easily see or produce the username if given the phone number of a Signal account. Note that if provided with the plaintext of a username known to be in use, Signal can connect that username to the Signal account that the username is currently associated with. However, once a username has been changed or deleted, it can no longer be associated with a Signal account.