Top all-time · #7652
Thijs Alkema
Personal blog · blog.thijsalkema.desecurityweb
Thijs Alkema writes xnyhps’ blog, a personal blog at blog.thijsalkema.de about security and web. Since 2013, 10 different Hacker News readers have linked it 24 times, most often “Piercing Through WhatsApp’s Encryption”. The last post was in 2016, but the archive is still widely read.
Too few sampled comments (6) to say how often HN recommends it.?
Why HN links it
Posts by Thijs Alkema on messaging security, including WhatsApp's encryption and authentication, the state of TLS on XMPP, and HTTPS attacks. HN commenters link the series as background on these topics.
Summarised by Claude from a sample of 6 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Most-linked posts?
- Piercing Through WhatsApp’s Encryption3 people · 3 mentions · first linked 2013-10-08
- HTTPS Attacks and XMPP 2: CRIME and BREACH2 people · 2 mentions · first linked 2014-08-07
- The state of TLS on XMPP (part 2)2 people · 2 mentions · first linked 2013-08-28
- Piercing Through WhatsApp’s Encryption (2)2 people · 2 mentions · first linked 2013-10-13
- XMPP Federation over Tor Hidden Services2 people · 2 mentions · first linked 2013-07-10
- Misconceptions About Forward Secrecy2 people · 2 mentions · first linked 2014-01-17
What Hacker News says?
They had some homebrew encryption and authentication before, see eg https://blog.thijsalkema.de/blog/2013/10/08/piercing-through... https://blog.thijsalkema.de/blog/2013/10/08/piercing-through...
Comment linking /blog/2013/10/08/piercing-through-whatsapps-encryption-2/
on “WhatsApp scaled to 1B users with only 50 engineers”Submitted Piercing Through WhatsApp’s Encryption as a story · 230 points
HN discussion> A few blips along the way will happen It is not a few blips. They have consistently shown to be unable to implement any kind of effective cryptography. Take this case as an example. They seem to have tried to prevent such kind of attack by encrypting the data on the SD Card with a static key. How hard would it have been to generate a random key and save the key on the internal storage? An other example is the tran…
Comment linking /blog/2013/10/08/piercing-through-whatsapp-s-encryption/
on “Any Android app can read your WhatsApp database”Submitted Is Google signing your chat messages? as a story · 90 points
HN discussionI believe the weakest link in OTR is its Diffie-Helman key exchange. If you break that you get the symmetric key and can decrypt everything passively. OTR has been using a 1536 bit modulus for its Diffie-Helman exchange since 2004 [1] (The weakest one from RFC 3526 [2]). Seems they are still using the same one today. In 2004 this was probably a fine choice, especially considering the tradeoff between CPU processing…
Comment linking /blog/2014/01/17/misconceptions-about-forward-secrecy/
on “Off-the-Record Messaging Protocol v3”Submitted Breaking Half of the Telegram Contest as a story · 80 points
HN discussionNot easy, but it can be applied to XMPP: https://blog.thijsalkema.de/blog/2014/08/07/https-attacks-an...
Comment linking /blog/2014/08/07/https-attacks-and-xmpp-2-crime-and-breach/
on “The State of Mobile XMPP in 2016”Submitted The State of TLS on XMPP as a story · 73 points
HN discussionI totally agree! I've been working on federating XMPP over hidden services ( https://blog.thijsalkema.de/blog/2013/06/11/xmpp-federation-... ), but I don't give a setup like that any chance to be possible on iOS.
Comment linking /blog/2013/06/11/xmpp-federation-over-tor-hidden-services/
on “Pirate Bay co-founder aims to launch surveillance-proof messaging app Hemlis”Submitted Misconceptions About Forward Secrecy as a story · 50 points
HN discussionPart 1 & 2 of the series: https://blog.thijsalkema.de/blog/2013/08/26/the-state-of-tls... https://blog.thijsalkema.de/blog/2013/08/28/the-state-of-tls...
Comment linking /blog/2013/08/28/the-state-of-tls-on-xmpp-2/
on “The State of TLS on XMPP”Submitted HTTPS Attacks and XMPP 2: CRIME and BREACH as a story · 10 points
HN discussionIn case you missed them, like me: Part 1 of blog post: https://blog.thijsalkema.de/blog/2013/10/08/piercing-through... Part 1 HN discussion: https://news.ycombinator.com/item?id=6512310
Comment linking /blog/2013/10/08/piercing-through-whatsapp-s-encryption/
on “Piercing Through WhatsApp’s Encryption (2)”Submitted Piercing Through WhatsApp’s Encryption (2) as a story · 6 points
HN discussionLet me shamelessly post this again: https://blog.thijsalkema.de/blog/2014/04/02/breaking-half-of... Even if you'd consider their protocol secure enough (which I don't), this third-party app was written by someone who thought rand48 was good enough for long-term crypto keys. I'd stay far, far away from this.
Comment linking /blog/2014/04/02/breaking-half-of-the-telegram-contest/
on “Telegram”Submitted The State of TLS on XMPP as a story · 6 points
HN discussionSubmitted Validate the Encoding Before Passing Strings to Libcurl or Glibc as a story · 2 points
HN discussionSubmitted Validate the encoding before passing strings to libcurl or glibc as a story · 2 points
HN discussionSubmitted CVE-2014-1361: SecureTransport Buffer Overflow as a story · 2 points
HN discussionSubmitted XMPP Federation over Tor Hidden Services as a story · 2 points
HN discussionSubmitted The state of TLS on XMPP (part 2) as a story · 2 points
HN discussionSubmitted HTTPS Attacks and XMPP 1: BEAST as a story · 1 points
HN discussion