Frederic Jacobs' Personal Blog
TLDR: Don’t setup DNS wildcards for GitHub Pages. Spammers are paying to use GitHub Pages infrastructure and squatting those subdomains to deliver SEO spam. When I set up my blog a few years back, I wanted something that had the lowest maintenance possible. I didn’t want to have to worry about updating servers, dealing with deployments and load balancing. GitHub Pages seemed like the solution I…
Earlier this year, we announced iMessage PQ3 , Apple’s formally-verified protocol for end-to-end encryption that amongst other updates provides post-quantum protections against “ Harvest Now, Decrypt Later ” attackers. In a previous blog entry, I talked about the Double Ratchet & the Quantum Computers , concluding that Double Ratchet was ‘ Quantum Annoying ’ and required an attacker to record…
Along with Chris Wood and Frank Denis , we have an RFC for RSA Blind Signatures for adoption in schemes like Privacy Pass. A security analysis of the scheme was also done by Anna Lysyanskaya.
I was delighted to be presenting at the Real World Crypto 2022 conference in Amsterdam on Exposure Notifications Private Analytics. It’s exciting to see large scale deployments of multi-party computation and that such systems are on-track to be standardized . #realworldcrypto and now we have @FredericJacobs on stage telling us about exposure notification and privacy! pic.twitter.com/zl3uxr0wxY…
I was happy to present at WWDC this year. You can find the video on developer.apple.com , or in the WWDC app. It was a pleasure to introduce a fast, easy-to-use and secure cryptographic (as in cryptography!) library for Swift.
A week ago, The Guardian broke an “exclusive” story titled “WhatsApp backdoor allows snooping on encrypted messages” . The Reporting My first reaction when I skimmed through the story is that this was nothing new . The Guardian’s source had already blogged about it on the 16th of April and given a lightning talk at CCC explaining the issue. Other people in the security community had already looked…
TLDR : Exit nodes with IPv6 addresses connect to check.torproject.org over IPv6, causing the IP not to be recognised as being one of an exit node. This triggers a scary “Sorry. You are not using Tor.” warning. When firing up Tor Browser today and checking if the browser was properly using Tor, I got the following scary message. What I assume happened Confused, I quickly checked if that was my IPv6…
A few months ago, I wrote a post on SMS logins following a wave of attacks attempting to take over Iranian Telegram accounts. Recently, there have been new confirmed cases of attacks in both Iran and Russia . Oleg Kozlovsky is an opposition activist and the director of Vision of Tomorrow Center in Moscow. In a Facebook post written in Russian , he explains how his Telegram account got hacked. At…
The double ratchet was previously known as the Axolotl ratchet. With recent developments in quantum information processing and computation, there has been a lot of chatter about moving to post-quantum cryptography. The NSA and NIST have already called for the standardization of post-quantum crypto and its swift adoption. Replacing some primitives is easier than others. Doubling symmetric key sizes…
I gave a TEDx talk in Brussels on the 14th of March on the topic of master keys. Giving a TEDx talk is a very challenging and intimidating experience for anyone who is not an english native speaker since the bar is so high and most speakers have extensive public speaking experience. Transcript Last August, I was getting ready for a trip to the United States. After packing my luggage, I thought it…