Forwarded from BlackBox (Security) Archiv
Oh dear. Signal now includes payment.
This is basically a bad idea, because it makes Signal a target for scammers. At the moment, it's just a target for intelligence agencies. Bad enough.
But Signal is not only adding payments. No, no. Signal is building in blockchain.
That's the final nail in the coffin. I've already stopped recommending Signal since they put in that disastrous pin update. Content-wise, it meant they were uploading your phonebook to the cloud. Wasn't as clearly communicated, but that was that. They do a pack of bullshit voodoo about your pin, then they use it to encrypt your phonebook, and then they upload it to the cloud.
Because smartphones don't do well at all for entering text or passwords, the pin is either useless because you can't get it entered, or it's useless because it has too little entropy and could just be tried through on the server.
And Signal didn't make this crappy pin opt-in but forced it on everyone once. That was the moment since when I stopped using Signal.
But now? Make a blockchain bullshit sandwich out of it too?
And not even a real blockchain but some voodoo handwaving hybrid snake oil.
I took a closer look at it last year. The whole thing is based on Intel SGX. That's Intel's enclave voodoo tech. According to Signal, it works like this: their crypto blockchain voodoo tech is open source and you can build it yourself. Then you can take a crypto checksum from it. Then you ask a proprietary unverifiable closed-source cloud service from Intel, and it will tell you the checksum from the stuff in the SGX enclave. Then you can see that the software was unmodified.
How does Intel's proprietary unverifiable closed-source voodoo service in the cloud know the checksum of the software in the SGX enclave? Well, it relies on Intel's proprietary unverifiable closed-source voodoo ware in your Intel CPU (in the management engine that Intel imposes on all customers in a non-disable way) with SGX.
You can already see: It's been a long time since I've been so unconvinced by a concept. The number of layers of "don't look too closely here" level crypto is staggering. The humanists among you will know the word meaning of crypto, and at this point enjoy the irony of crypto-voodoo being used here as a flimflam ingredient for a bullshit cocktail of wild diversionary hand movements otherwise only known from hat players and stage magicians.
https://blog.fefe.de/?ts=9e9221ad
#signal #payments #komment #thinkabout
📡 @nogoolag 📡 @blackbox_archiv
This is basically a bad idea, because it makes Signal a target for scammers. At the moment, it's just a target for intelligence agencies. Bad enough.
But Signal is not only adding payments. No, no. Signal is building in blockchain.
That's the final nail in the coffin. I've already stopped recommending Signal since they put in that disastrous pin update. Content-wise, it meant they were uploading your phonebook to the cloud. Wasn't as clearly communicated, but that was that. They do a pack of bullshit voodoo about your pin, then they use it to encrypt your phonebook, and then they upload it to the cloud.
Because smartphones don't do well at all for entering text or passwords, the pin is either useless because you can't get it entered, or it's useless because it has too little entropy and could just be tried through on the server.
And Signal didn't make this crappy pin opt-in but forced it on everyone once. That was the moment since when I stopped using Signal.
But now? Make a blockchain bullshit sandwich out of it too?
And not even a real blockchain but some voodoo handwaving hybrid snake oil.
I took a closer look at it last year. The whole thing is based on Intel SGX. That's Intel's enclave voodoo tech. According to Signal, it works like this: their crypto blockchain voodoo tech is open source and you can build it yourself. Then you can take a crypto checksum from it. Then you ask a proprietary unverifiable closed-source cloud service from Intel, and it will tell you the checksum from the stuff in the SGX enclave. Then you can see that the software was unmodified.
How does Intel's proprietary unverifiable closed-source voodoo service in the cloud know the checksum of the software in the SGX enclave? Well, it relies on Intel's proprietary unverifiable closed-source voodoo ware in your Intel CPU (in the management engine that Intel imposes on all customers in a non-disable way) with SGX.
You can already see: It's been a long time since I've been so unconvinced by a concept. The number of layers of "don't look too closely here" level crypto is staggering. The humanists among you will know the word meaning of crypto, and at this point enjoy the irony of crypto-voodoo being used here as a flimflam ingredient for a bullshit cocktail of wild diversionary hand movements otherwise only known from hat players and stage magicians.
https://blog.fefe.de/?ts=9e9221ad
#signal #payments #komment #thinkabout
📡 @nogoolag 📡 @blackbox_archiv