Top all-time · #952
Tony Arcieri
Personal blog · tonyarcieri.comprogrammingsecurityeconomics
Tony Arcieri's personal blog at tonyarcieri.com covers programming, security and economics. Since 2012, 72 different Hacker News readers have linked it 114 times, most often “Flaws in deterministic password managers”. The last post was in 2019, but the archive is still widely read.
Tony Arcieri | Hi there. These days I dabble in Rust and cryptography, but in the past made the Celluloid actor framework for Ruby and the Reia programming language
Most-linked posts?
- Flaws in deterministic password managers17 people · 20 mentions · first linked 2016-11-22
- What’s wrong with in-browser cryptography?10 people · 11 mentions · first linked 2016-01-23
- All the crypto code you've ever written is probably broken (2012)6 people · 14 mentions · first linked 2015-11-18
- What's wrong with in-browser cryptography?6 people · 7 mentions · first linked 2013-12-30
- /would-rust-have-prevented-heartbleed-another-look6 people · 6 mentions · first linked 2016-07-10
- On the dangers of a blockchain monoculture5 people · 8 mentions · first linked 2016-01-05
- The Tether Conundrum: a look into a suspicious cryptocurrency4 people · 5 mentions · first linked 2018-01-19
- Would Rust have prevented Heartbleed? Another look3 people · 3 mentions · first linked 2015-03-17
- Key rotation, user experience, and crypto reporting3 people · 3 mentions · first linked 2017-01-14
- All the crypto code you've ever written is probably broken2 people · 3 mentions · first linked 2012-11-13
What Hacker News says?
> There definitely exists a lack of respect for the craft of front-end development within our industry. This sort of attitude is not helping. There is xenophobia involved in people's attitudes toward kebabs. It doesn't change the impact of phosphates on the human body. Here: https://www.bbc.co.uk/news/world-europe-42238363 Your argument doesn't change the impact of poorly-encapsulated complexity on the brains and me…
Comment linking /would-rust-have-prevented-heartbleed-another-look
on “Things I wish I’d known about CSS”Submitted Would Rust have prevented Heartbleed? Another look as a story · 257 points
HN discussionI have tried deterministic password managers, but as with most solutions they have flaws and tradeoffs[1] to consider. [1] https://tonyarcieri.com/4-fatal-flaws-in-deterministic-passw... [2] Also related: https://news.ycombinator.com/item?id=13016132
Comment linking /4-fatal-flaws-in-deterministic-password-managers
on “Man jailed 16 months, and counting, for refusing to decrypt hard drives”Submitted Flaws in deterministic password managers as a story · 196 points
HN discussion>That means the hashing needs to be done client side, probably with JavaScript. Is there any safe way to do that? No [0,1...n]. Note that these articles are about encryption, but the arguments against javascript encryption apply to hashing as well. Also consider that no one logs this stuff accidentally to begin with. If the entity controlling the server and writing the code wants to log the passwords, they can rewri…
Comment linking /whats-wrong-with-webcrypto
on “Twitter urges users to change passwords after computer 'glitch'”Submitted On the dangers of a blockchain monoculture as a story · 195 points
HN discussionThis post is filled with a large number of factual inaccuracies, so numerous I wrote a blog post in response: https://tonyarcieri.com/factual-inaccuracies-of-facebook-lib...
Comment linking /factual-inaccuracies-of-facebook-libra-is-architecturally-unsound
on “Facebook Libra Is Architecturally Unsound”Submitted A tale of two cryptocurrencies: Ethereum and Bitcoin’s ongoing challenges as a story · 144 points
HN discussionTether has looked like a scam for years. Here's a post from 2018 about it: https://tonyarcieri.com/the-tether-conundrum
Comment linking /the-tether-conundrum
on “Anyone Seen Tether’s Billions?”Submitted Introducing TJSON, a stricter, typed form of JSON as a story · 140 points
HN discussionPeople are trying to solve a lot of interesting problems with blockchain, but I fear it's become the ultimate shoehorn solution for the modern era. See also: https://tonyarcieri.com/on-the-dangers-of-a-blockchain-monoc... I've had meetings with prospective clients that opened with, "We have $problem, can we use blockchain to solve it?" where anything that doesn't qualify as a blockchain is cast to the wayside becaus…
Comment linking /on-the-dangers-of-a-blockchain-monoculture
on “Building for the Blockchain”Submitted Factual Inaccuracies of “Facebook Libra Is Architecturally Unsound” as a story · 138 points
HN discussionYes, you are correct. Unless browser extensions are used (and even then) the web is not a good platform for cryptography. The web is a platform for letting a potential attacker run untrusted code on your computer without all hell breaking loose, not for building trusted cryptography applications: http://tonyarcieri.com/whats-wrong-with-webcrypto
Comment linking /whats-wrong-with-webcrypto
on “Keybase.io”Submitted All the crypto code you've ever written is probably broken as a story · 112 points
HN discussionDisclaimer: stateless/deterministic password managers have some serious flaws compared to stateful/vault password managers. See https://tonyarcieri.com/4-fatal-flaws-in-deterministic-passw... for example
Comment linking /4-fatal-flaws-in-deterministic-password-managers
on “Pass: A standard Unix password manager”Submitted It’s time for a memory safety intervention as a story · 102 points
HN discussionHere is a writeup: https://tonyarcieri.com/4-fatal-flaws-in-deterministic-passw...
Comment linking /4-fatal-flaws-in-deterministic-password-managers
on “KeepassXC – A cross-platform community fork of KeepassX”Submitted 2012: The year Rubyists learned to stop worrying and love threads as a story · 99 points
HN discussionI'd recommend reading this article, which discusses some big problems with this approach to password management: https://tonyarcieri.com/4-fatal-flaws-in-deterministic-passw...
Comment linking /4-fatal-flaws-in-deterministic-password-managers
on “KeepassXC – A cross-platform community fork of KeepassX”Submitted Miscreant: a multi-language misuse resistant encryption library as a story · 97 points
HN discussionIn the case of LibreSSL, it's probably not going to happen very soon; the OpenBSD devs are very much C programmers (and Ted Unangst already addressed this in the case of Heartbleed, though his methodology is the subject of some contention: http://www.tedunangst.com/flak/post/heartbleed-in-rust ). While Ted's post has been criticized by a few Rust programmers (see: http://tonyarcieri.com/would-rust-have-prevented-hea…
Comment linking /would-rust-have-prevented-heartbleed-another-look
on “Rust once, run everywhere”Submitted CREAM: the SSL attack you’ve probably never heard of as a story · 90 points
HN discussionAbsolutely. You're confusing Heartbleed and Tedbleed. https://tonyarcieri.com/would-rust-have-prevented-heartbleed...
Comment linking /would-rust-have-prevented-heartbleed-another-look
on “BearSSL – Smaller SSL/TLS”Submitted "DCI" in Ruby is completely broken as a story · 83 points
HN discussionHere's a good write-up about the issues with Tether from a few years ago: https://tonyarcieri.com/the-tether-conundrum
Comment linking /the-tether-conundrum
on “Tether price manipulation”Submitted The Tether Conundrum: a look into a suspicious cryptocurrency as a story · 80 points
HN discussionRelated reading: https://tonyarcieri.com/would-rust-have-prevented-heartbleed...
Comment linking /would-rust-have-prevented-heartbleed-another-look
on “Rustls: new, modern TLS library written in Rust”Submitted Volapük: A Cautionary Tale for Language Communities as a story · 80 points
HN discussionhttps://tonyarcieri.com/4-fatal-flaws-in-deterministic-passw...
Comment linking /4-fatal-flaws-in-deterministic-password-managers
on “Lesspass – open-source stateless password manager”Submitted What's wrong with in-browser cryptography? as a story · 73 points
HN discussion
