@TomK. It's nice because it's simple and open source, but its detection rate isn't ideal. The primary issue is that its heuristics detection is severely lacking. It's still pretty good if you need an AV though for e.g. offline scanning.

@J.J You should publish an article about them contacting you.

Also, IANAL but what you are saying is, in my subjective understanding of the relevant laws, completely legal due to the fact that you don't present any statements of fact which are false. "Given the track record of companies" is subjective, and "it makes it hard for us to believe" is explicitly an opinion.

If you had said "MindGeek claims AgeID won't track you, but it does", then you might be in trouble, but that's not what you said, so that's not an issue.

Vulnerability in TLS 1.3 (PSK mode): eprint.iacr.org/2019/347.pdf

Who uses preshared keys?

The selfie attack how apropos

Also regarding the WPA3 vuln: mailarchive.ietf.org/arch/msg/cfrg/scLoq7DvtXzo9Jl9AG9fQOcSGsM

cf. arstechnica.com/information-technology/2013/12/…

Whats the connection with with 2013 proposal, I don't follow

@this.josh The bug in WPA3 in 2019 was using the protocol which was heavily influenced (potentially maliciously) by an NSA employer in 2013.

Ok, PAKE is a preshared key scheme

"SAE handshake is a variant of the Dragonfly handshake defined in RFC 7664, which in turn is based on the SPEKE handshake"

mathyvanhoef.com/2018/03/wpa3-technical-details.html

It appears that the Simultaneous Authentication of Equals (SAE) handshake was an attempt to improve on the WPA2 4-way handshake

@this.josh Yes, SAE is a way to separate authentication and confidentiality, by getting rid of WEP/WPA/WPA2's stupid combination of the two where a bad password results in weak encryption (which is not necessary).

This just seems like a terrible TLS mode that shoudln't be allowed, PSK without authentication :P

Well SAE and the PSK issues are separate.

Though I haven't looked into the PSK issue yet. I still have the PDF open for later reading. It seems like a difficult thing to fuck up, since you could presumably use the PSK directly as if it were the master secret and use it to derive the MAC key.

It's a very clever attack, it hinges on the perfect symetry of the protocol

github.com/cozybit/authsae

Well at least it can be fixed by the implementers.

Its really hard to know who is implementing the WiFi you are using.

Thats why I like wires

Atheros or Broadcom or Ralink.

or Cisco, Apple, Dlink, Google, MediaTek, Nest

But 99% of the time, they'll use one of the above.

Of course, just knowing who implements it doesn't know whether or not they actually implemented it secure and correctly... See Broadcom's Wi-Fi RCE mistake.

And how old the implementation is

Yep. Not many people RE the firmware on the device.

dont forget ZTE, Huawei, Xiaomi, Samsung

Do they even create their own wireless chips?

DRAM for example is usually either SK Hynix or Samsung, no matter the vendor.

I think the same is true for Wi-Fi where it's controlled by an oligopoly.

I think certain chip designs, and functional areas are licensed

Maybe. I don't know much about wireless hardware, sadly.

or be be in part or fully reverse enginered

Looks like you can license WiFi IP cores from NXP, Wipro-NewLogic, Ceva, Ittiam Systems, Imagination Technologies

@forest bugs in PSKs? color me surprised

is this worth reading?

I think its worth reading.

Haven't read it yet.

:P

They wouldn't even do that.

They would stop censorship of any kind.

And instead work on improving voluntary parental controls.

Because that kind of thing should be up to the parents.

Not the government or some big corporation.

That's retarded.

Well, at least more people will start using anonymity and privacy tools.

Actually I should look into it more. I might be able to profit off of this.

So like "Click here if you're over 18", but with a license?

Is it enforced by porn sites or by ISPs?

I assume the UK gov't will block porn sites which don't enforce this?

ah

I'm probably too late to make much money off this anyway. hm

Yeah but I was thinking more about bypassing the blocks.

A paid but easy to use service that automatically turns on for porn sites, for example.

That would allow people to avoid the need for slowing down their entire traffic.

And it would make it easier for people who don't know how or can't install a full VPN (e.g. a browser extension or custom DNS server).

Do you know of any companies with similar products? Things I can look into?

I mean for AgeID-specific VPNs/proxies.

Maybe I'm not too late then. :D

What kind of price range do you think would be reasonable for UK?

I know nothing about the UK (I've only done this kind of thing in China and the US).

Yeah I could probably do that. Plus then I could allow free accounts that just have lower speeds (plus then people who are technically too young to pay for it could still evade the blocks. I mean who is the government kidding? All ages watch porn).

Do you know how the UK implements its blocks? I assume DNS blacklisting? Or do they do obnoxious things like SNI sniffing like Russia's Roskomnadzor?

ah

Then I imagine they'll be doing the bare minimum.

Via DNS hijacking or by blocking it from the ISP's own DNS?

(IOW is it as easy to bypass as switching to 8.8.8.8/8.8.4.4?)

Then DNS-over-HTTPS and DNS-over-TLS would bypass it as well?

@forest long time no see, how have you been?