• 3 Posts
  • 36 Comments
Joined 2 years ago
cake
Cake day: June 12th, 2023

help-circle









  • Region locked to USA so here’s a screenshot.

    Full Article

    FBI warns users to encrypt text messages for cybersecurity. Here’s how to do it Sunshyne Lynch Binghamton Press & Sun Bulletin

    The FBI is warning phone users to encrypt their text messages, especially if you send messages between Apple and Android users.

    The FBI and the Cybersecurity and Infrastructure Security Agency (CISA) issued a statement on Nov. 13 that hackers affiliated with People’s Republic of China (PRC) were targeting “telecommunications infrastructure” in a “broad and significant cyber espionage campaign.”

    The hackers targeted “a limited number of individuals who are primarily involved in government or political activity,” according to the statement, and stole “customer call records data” and “certain information that was subject to U.S. law enforcement requests pursuant to court orders.”

    Despite the FBI and CISA’s continued investigation, cybersecurity officials have been unable to stop the hackers.

    What text messages should be encrypted Because of the cyberattack, officials are warning smartphone users to use texting apps such as WhatsApp or Signal, as messages between Apple and Android users are not encrypted.

    Messages between two Apple devices are safe, and messages between two Android devices are safe, but messages between an Apple device and and Android device are vulnerable.

    Here are two text messaging apps that use end-to-end encryption. Once you’ve downloaded either of these apps to your smartphone, you can also link them to your desktop computers.

    How to encrypt text messages with WhatsApp To ensure that messages between Apple and Android users are encrypted, you can use the text messaging app WhatsApp.

    To download the app, Apple users should visit the App Store and Android users should visit the Google Play app, and download WhatsApp Messenger. The app is free to download and use.

    Once you’ve downloaded the app, you’ll need to accept the Terms and Conditions and allow the app to have certain permissions, like contacts and notifications.

    Then, you’ll need to select the country you live in and register a phone number you own. This phone number must be able to receive phone calls and text messages, so it cannot be a landline or toll-free number.

    WhatsApp will then give you the option for a voice call or to text a code to the phone number you entered in order to verify the number.

    Once the number is verified, you must put in the year you were born and your name and click “Done.” After you’ve completed this step, you can begin texting and calling your contacts through WhatsApp.

    To use this app, you must have Wi-Fi or cellular data.

    How to encrypt text messages with Signal Signal is another encrypted text messaging app to ensure messages between Apple and Android users are protected.

    To download the app, Apple users should visit the App Store and Android users should visit the Google Play app, and download Signal - Private Messenger. The app is free to download and use.

    Once you’ve downloaded the app, you’ll need to accept the Terms and Conditions and allow the app to have certain permissions, like contacts and notifications.

    Like WhatsApp, you’ll enter in a phone number that you own and is able to make calls and send and receive text messages.

    Signal will text you a verification code that you’ll need to enter into the app that verifies the phone number. After the number has been verified, you’ll create a PIN that allows you to access your information and ensures your information is encrypted.

    You’ll then enter in your first and last name to create your Signal profile. After creating your profile, you can begin texting and calling through Signal. The app will show you the contacts in your phone that already have the app.

    To use this app, you must have Wi-Fi or cellular data.








  • Ownership of the domain is verifiable on the blockchain, if the same wallet that owns the domain (nft) also publishes the pub key (owns the pub key nft or key data is embedded in the domain name nft) you can verify that the key is valid.

    IMO blockchain is more trustworthy than any single CA because you aren’t trusting a single entity, but a decentralized network of nodes. Assuming that most nodes are honest you can query 100 independent nodes for the same data, if 99 say the same thing you can be fairly confident that the data is valid. You can also run your own node and not have to trust anyone.

    To protect against MITM of your connection redirecting all traffic to their malicious node, some well known and trusted nodes would be hardcoded in the browser/OS software along with their public signing key to verify the signed data they send you, and genesis block data in case you want to run a node yourself. Signing keys of nodes would also be published to the blockchain. Think a unified, immutable, cryptographically verifiable, distributed database of public key - domain name pairs, which is what blockchain basically is. Encrypting the connection is a good idea too, extra privacy is always welcome.

    The biggest advantage here is that every single pub key (certificate) is stored by every single node (CA), so if one node goes rogue or is compromised and starts serving false data, it will be immediately discovered by the client by comparing it’s data to the data from other nodes, and can be immediately and verifiably reported to the network, even in the case of a targeted attack, because all data recived from the nodes is signed.

    No solution is perfect and this one is not an exception, if your hardware or your os/browser is compromised there is nothing short of manually checking certificate data or using an external device to verify it, that can be done, but that’s true for most IT systems, including the current TLS certification and authority based system.

    Blockchain is a well tested technology that has proven itself to work by being a core part of a trillion dollar industry and was specifically designed to eliminate the need for trusting a 3rd party. It seems like a natural solution to the biggest problem with CAs - trusting a 3rd party. It’s honestly sad that so many people dismiss it or are downright against it coz “crypto”, even when no crypto currency is invloved. I guess they spent so much time hating it they can’t even admit it might be useful to them after all.

    Thanks for asking for a follow-up instead of just downvoting.


  • Ownership of the domain is verifiable on the blockchain, if the same wallet that owns the domain (nft) also publishes the pub key (owns the pub key nft or key data is embedded in the domain name nft) you can verify that the key is valid.

    IMO blockchain is more trustworthy than any single CA because you aren’t trusting a single entity, but a decentralized network of nodes. Assuming that most nodes are honest you can query 100 independent nodes for the same data, if 99 say the same thing you can be fairly confident that the data is valid. You can also run your own node and not have to trust anyone.

    To protect against MITM of your connection redirecting all traffic to their malicious node, some well known and trusted nodes would be hardcoded in the browser/OS software along with their public signing key to verify the signed data they send you, and genesis block data in case you want to run a node yourself. Signing keys of nodes would also be published to the blockchain. Think a unified, immutable, cryptographically verifiable, distributed database of public key - domain name pairs, which is what blockchain basically is. Encrypting the connection is a good idea too, extra privacy is always welcome.

    The biggest advantage here is that every single pub key (certificate) is stored by every single node (CA), so if one node goes rogue or is compromised and starts serving false data, it will be immediately discovered by the client by comparing it’s data to the data from other nodes, and can be immediately and verifiably reported to the network, even in the case of a targeted attack, because all data recived from the nodes is signed.

    No solution is perfect and this one is not an exception, if your hardware or your os/browser is compromised there is nothing short of manually checking certificate data or using an external device to verify it, that can be done, but that’s true for most IT systems, including the current TLS certification and authority based system.

    Blockchain is a well tested technology that has proven itself to work by being a core part of a trillion dollar industry and was specifically designed to eliminate the need for trusting a 3rd party. It seems like a natural solution to the biggest problem with CAs - trusting a 3rd party. It’s honestly sad that so many people dismiss it or are downright against it coz “crypto”, even when no crypto currency is invloved. I guess they spent so much time hating it they can’t even admit it might be useful to them after all.

    Thanks for asking for a follow-up instead of just downvoting.


  • This is slightly off-topic but I was thinking about it and all of thoes isues can be solved by utilizing blockchain. Imagine a world where instead of CAs, decentralized domain (unstoppable domains, ENS etc.) owners publish their pub keys to the blockchain, the client can than query multiple nodes or store the chainstate locally. When establishing a connection client sends a secret handshake message + clients’ pub key encrypted with domains’ pub key. To complete the handshake server responds with the same secret message encrypted with clients’ pub key.



  • I don’t have cameras in my store and i doubt you walk around with a gopro strapt to your forehead. Crypto stores develop reputation as well.

    On what are you basing the opinion that MUCH larger percentage of the crypto ecosystem is devoted to scams? Legal action is the only recourse you have with cash, the same can be done with crypto. If design of crypto incentives scams then so does the design of cash.

    Yes, but gullibility is the #1 problem and again, crypto has no safeguards or recourse.

    Neither does cash, gift cards and all of the methods Nigerian princes and certified Microsoft technicians from IRS have been successfully using for years to scam their victims.

    The whole point of making the system decentralized is so that a powerful actor can’t seize control over it. There are hundreds of chains with different rules and regulations, you can chose the one that fits your needs, and if a powerful actor tries to change it’s rules the community can decide that the version of the chain with altered rules isn’t one they want to take part in and split off. It has happened before with block size wars that resulted in btc/bch split. Both chains run fine to this day, each with their own rules decided by their own community.


  • How is it harder to scam with cash? You come to my store to buy something, you hand me the bill, I take it and don’t give you anything in return. Even if you call the police it’s my word against yours, how will you prove that I took your money?

    Most scams are done irl with FIAT (fake bills, overpriced cooking pots, fake tech support, palm reading, IRS google play cards, nigerian princes, fake e-bay items, fake charge-backs for real e-bay items, uber ride cancels, uncancellable memberships, hidden costs…) at the end of the day you can’t protect everyone from everything, especially from their own gullibility. The design of crypto, when used properly, prevents all of the non-gullibility based scam types (chargebacks, cancels, hidden costs, automatic deductions etc.). For some people complete control over their money is a plus and some prefere to have it handled by banks and governments, maybe crypto just wasn’t made for the latter.


  • Scammers have been doing that with cash, PayPal, gift cards and even regular bank transfers that are supposedly so safe.

    Crypto transactions being irreversible are no different than cash or gold transactions, you can’t magically revert giving someone cash once you realize they scammed you. Only thing you can do is report it to the police. Crypto works the same way, but for transparent coins like btc, or eth you at least have a proof that a transaction took place unlike cash.