Personally I am not a fan of RocksDB because of it being such a headache to get basic things working like replication, clustering, high availability. But I recently used continuwuity to host a matrix homeserver hosting thousands of users (it never meant to grow that much) and the whole time I had this fear of losing everyone’s data because I had no replication or backups of the database and no…
Haraka Hash is really interesting to me, it’s not a typical checksum hash function like SHA, or Blake, nor it is a KDF like Argon2 or scrypt. Instead, Haraka is designed as an AES-based permutation , optimized for short inputs and extremely high throughput on modern CPUs with AES-NI instructions. But why? Why would anyone use this? Well, for crypto… Why Use Haraka in Crypto? Haraka’s core idea is…
Disclaimer : This might sound like a stupid idea, but believe me, I had good reasons for it. In the previous post on the making of SARE , I went over how and why I integrated master seeds into the architecture. That laid the groundwork for consistent key derivation across different cryptographic operations. If you haven’t read that post, you can find it here - that’ll help this one make more…
A few years ago, I started working on a project called the Sare Project. Sare stands for Safe At Rest Encryption. I wanted to make a hybrid post-quantum encryption library and tool to be a post-quantum replacement for GPG. I have been away from this project for almost a year, and when I opened the codebase I didn’t know what I had done. So I thought as I read my own old code, I could explain why I…
There’s been a lot of talk lately about Qubic , a mining pool that might be trying to pull off a 51% attack on Monero . If you’re not familiar, a 51% attack happens when one miner or mining pool gets control of more than half of the total network hashrate in a proof-of-work system, like Monero. That kind of control gives them a lot of power over the network. With over 51% of the hashrate, they…
Every time mass protests erupt in Iran, a familiar pattern follows: the flow of information stops. The internet slows to a crawl or disappears entirely. But how does a modern country survive cutting itself off from the internet? Wouldn’t that break everything? Not quite, because the Islamic Republic has spent the last decade building an internet within the internet. The National Information…
Freedom starts from within, once we break through the external controls and take control over our own lives and decisions. Although avoiding external controls might not sound feasible at the moment, just like avoiding cholera was not feasible a hundred years ago, the history of humanity is full of impossibilities that now just seem stupid to us. Just like how absurd it sounds that people died from…
Telegram is really close to the worst when it comes to privacy, security, and anonymity, which highly matters if you are an activist, a protester, a journalist, or even a normal paranoid human being. Telegram is a platform that keeps on animating its emoji reactions in every update and milking users for money by giving them a “premium” subscription that essentially provides nothing “premium” in…
Since Trump’s election and even before that, news kept coming out about how crypto was going to change the world, how the US was going to become the crypto capital of the world, and how they wanted to build strategic reserves of Bitcoin, Ethereum, Solana, Ripple, and others. At the same time, however, they de-listed Monero from major exchanges like Binance and even criminalized this…
There are a lot of cool projects that unfortunately have been abandoned or unmaintained for years, but that doesn’t mean they added no value. Studying what they’ve done, taking their unique ways of doing certain things and their problems can lead us to build something better. Bitmessage is one of those projects; it is an email-like service but fully peer-to-peer and decentralized, built upon the…
I had an idea for a project that required Proof of Work as a part of it, but I couldn’t find any Rust libraries that would have Argon2id or Scrypt algorithms and were meant to provide proof of work functionality without being tied to a specific blockchain. So, I decided to develop my own. When I was doing so, I wanted to show how Rust’s data types can make such things easy and clean. Okay, but…
I was playing a CTF at 247CTF.com , called “Secure Session” with the description, “If you can guess our random secret key, we will tell you the flag securely stored in your session.” It was surprisingly easy to capture the flag; it took less than a minute. And that’s because sessions aren’t secure storage for sensitive data. The code was a simple Flask app: import os from flask import Flask ,…
This is a guide for those who live under heavy internet censorship and restrictions and want to host their own censorship circumvention tools and services to bypass the firewalls and access the free internet. To understand how these censorship systems and firewalls work, you can check out my previous post by clicking here. To host your own VPN and Proxy services, you will need a VPS with…
If you have ever lived in a country with advanced internet censorship, such as China or Iran, you would know how challenging it is to bypass these restrictions. In this post, I want to discuss the methods by which these firewalls block and detect your traffic, as well as the circumvention tools and methods available for each of them. An advanced censorship system can employ a combination of these…
I have two Linux machines that I constantly switch between, and I had a problem syncing my ZeroNet 1 data between my machines. Additionally, I didn’t want to share my data with a third-party server. So, I decided to make a portable USB stick for my ZeroNet that could not only be used with my devices but also with any other device running Linux. This approach also solved another problem I had with…
I recently started doing CTF challenges. A few days ago, I was working on a challenge from 247CTF.com. I found a challenge that, in my opinion, shows why using ECB(Electronic Codebook) mode for encrypting with block ciphers like AES or Twofish isn’t a good idea. So, I decided to write a series of blog posts where I solve these challenges and explain how to prevent these kinds of attacks. The…
In my previous post, I took a technical look at ZeroNet , explaining how it works and the technologies it uses to create a peer-to-peer web-like network. In this post, I want to discuss how you can maintain privacy and security in this network, explore the potential threats, and provide some techniques to enhance your privacy and security. I will divide this guide into three main sections:…
ZeroNet has always been a project that I’m very passionate about, and I enjoy contributing to it. It is a Peer-to-Peer Web-Like Network that cannot be censored or taken down, thanks to its decentralized nature. When I first started exploring ZeroNet, I struggled to find comprehensive documents or blog posts that provided a clear understanding of the network. Therefore, I decided to write this blog…
As censorship systems like GFW(Great Firewall of China) and Roskomnadzor(Russia’s Federal Service for Supervision of Communications, Information Technology) have evolved, people have fought back and developed numerous tools, methods, and protocols to bypass these firewalls and connect to the open and free internet that most people know. Among these protocols, there is an underrated protocol named…
I have been using rbash to restrict users’ shell access for the past year, and there have been some problems with it that finally led me to write my own shell. The biggest problem was that users could run bash , dash , or zsh , or any other shell, allowing them to bypass the restrictions. Another issue was the ability for users to execute unauthorized software, which was not restricted enough for…
A few months ago, I accidentally came across a highly underrated cryptocurrency named VerusCoin , and I immediately fell in love with it because of its unique features and the techniques that VerusCoin’s developers used to provide those features. And in this post, I wanted to highlight the features and technologies that I believe made VerusCoin unique and practical as a cryptocurrency and…
If you care about privacy and anonymity, or if you live in a country with very restricted internet access, you might have used Tor (The Onion Router) for anonymity or to bypass censorship. In both cases, you might need to use Bridges to connect to the Tor network or to prevent your ISP from knowing that you’re using Tor. What bridges do is obfuscate the traffic and act as alternative entry nodes,…
After years of dedication to privacy and anonymity in the online world, I have come across a few simple things that can put you above average in terms of privacy and security. Think before share What you share online can stay out there forever, so it’s best to think about what you’re about to share on the internet. Only share your personal information if you have to. Use a password manager Doing…
A specter is haunting the modern world, the specter of crypto anarchy. Computer technology is on the verge of providing the ability for individuals and groups to communicate and interact with each other in a totally anonymous manner. Two persons may exchange messages, conduct business, and negotiate electronic contracts without ever knowing the True Name, or legal identity, of the other.…