Share this page!

Matthew Green Profile picture
Twitter logo
30 Dec 21, 4 tweets, 1 min read
Moms are the real tracking threat.
A friend recently lost his wallet with a Tile inside it, and rather than get the thing back we’ve been watching it wander around Baltimore for the last three weeks.
It turns out that knocking on random doors in Fells Point is a very bad strategy for recovering lost things.
Unless you like to fight.

• • •

Missing some Tweet in this thread? You can try to force a refresh
　

Keep Current with Matthew Green

Matthew Green Profile picture

Stay in touch and get notified when new unrolls are available from this author!

Read all threads

This Thread may be Removed Anytime!

PDF

Twitter may remove this content at anytime! Save it as PDF for later use!

Try unrolling a thread yourself!

how to unroll video
  1. Follow @ThreadReaderApp to mention us!

  2. From a Twitter thread mention us with a keyword "unroll"
@threadreaderapp unroll

Practice here first or read more on our help page!

More from @matthew_d_green

Matthew Green Profile picture
27 Dec 21
Apropos Moxie’s thread, Telegram’s E2E is so obviously homebrewed, it’s like sending a chat to the late 1990s.
So the remote client picks the DH parameters (why!) and sends them to you, where you have to carefully check that they’re constructed correctly (pretty sure these checks were added later.)
Then there’s this weird thing about the server picking randomness, which used to be a total security vulnerability since it allowed the server to pick the DH secret (now fixed, I think) and still more complicated group membership checks.
Read 6 tweets
Matthew Green Profile picture
21 Dec 21
Oh this isn’t good, Binance. blog.trailofbits.com/2021/12/21/dis… Image
I’m uncomfortable using “1” as an x-coordinate for Shamir, since my stupid intuition tells me “it’s so close to 0” :) But Binance just letting you blast away at q, 2q, etc.
One of my favorite things about cryptocurrency is you never have to say “well the impact can’t be that bad” because you know someone secured like $100m with it.
Read 4 tweets
Matthew Green Profile picture
20 Dec 21
No, no, no, it does not. What is wrong with you people. Stop this. Image
What even is this. You had an explicitly *non-cryptographic RNG* but you’re upset it doesn’t display cryptographic properties!? Image
Rust cryptography task force: wake up and get on top of this before your beloved language gets ruined by idiots who don’t even know what they want.
Read 9 tweets
Matthew Green Profile picture
19 Dec 21
Does anyone know how Apple’s privacy protocol for AirTags combines with their anti-tracking features? Seems like the two should be incompatible. (I have some guesses but I’m wondering if it’s officially documented.)
My guess is that the AirTag cycles its broadcast pseudonym at a slower rate than your phone can scan, so if your phone detects many broadcasts of the same pseudonym within some time window it says “ah, an AirTag is near me.” And it links this over many windows.
In other words, Apple is taking advantage of a weakness in their anti-tracking protocol to do tracking, in the service of preventing a different kind of tracking.
Read 5 tweets
Matthew Green Profile picture
15 Dec 21
🧐 macrumors.com/2021/12/15/app…
Pretty confident Apple is going to ditch client-side CSAM scanning in favor of server-side CSAM scanning. This will be an improvement, but will leave them in a tight corner with E2EE.
Still a massive improvement: the deployment of client-side scanning for cloud backups would have been an asterisk on all device privacy forever, particularly as cloud backups become increasingly non-optional.
Read 9 tweets
Matthew Green Profile picture
11 Dec 21
Watching this log4j bug metastasize, I’m seeing people ask why industry doesn’t fund open source. I don’t have a great answer, but I have some thoughts following the experience with Heartbleed in ‘14. 1/
When Heartbleed dropped, it was very similar to log4j: an underfunded OSS project (OpenSSL) that nobody thought about, but was *everywhere*. It took everyone by surprise, and even woke industry up. The result was a surge of funding. 2/
Industry (not the government, who still though “infrastructure” meant dams and bridges) suddenly realized they were using this stuff everywhere. So the Linux Foundation created the Core Infrastructure Initiative (now the OpenSSF). coreinfrastructure.org 3/
Read 11 tweets

Did Thread Reader help you today?

Support us! We are indie developers!

This site is made by just two indie developers on a laptop doing marketing, support and development! Read more about the story.

Become a Premium Member ($3/month or $30/year) and get exclusive features!

Become Premium

Too expensive? Make a small donation by buying us coffee ($5) or help with server cost ($10)

Donate via Paypal

Or Donate anonymously using crypto!

Ethereum

0xfe58350B80634f60Fa6Dc149a72b4DFbc17D341E copy

Bitcoin

3ATGMxNzCUFzxpMCHL5sWSt4DVtS8UqXpi copy

Thank you for your support!

Follow Us on Twitter!

Like this author's thread?

Get emails when @matthew_d_green has new unrolls!

Check out other threads from @matthew_d_green!

Read all threads by @matthew_d_green

:(