News for hackers. Stuff that matters.
Re:Adam Langley's Pond: Secure Async Messaging by carbocation on Saturday July 13, 2013 @07:44PM (#6039252)
> "Pond seeks to prevent leaking traffic information against everyone except a global passive attacker."

My favorite line in the article. It's a nice nod to the fact that this Achilles heel is an issue that he is aware of / takes seriously.

Re:Adam Langley's Pond: Secure Async Messaging by tptacek on Saturday July 13, 2013 @10:22PM (#6039642)
Adam Langley is the real deal. He's also a large part of the reason Google managed to deploy forward secrecy, and the author of the Golang TLS stack.
Re:Adam Langley's Pond: Secure Async Messaging by lmgftp on Saturday July 13, 2013 @09:09PM (#6039464)
Contrasted with the "forward":

   |Note: recent events have lead to these topics being in the news quite often in recent weeks. However, Pond is not a reaction to those events - it was started nearly a year ago.
Traffic information, of course, isn't the whole conversation, so his wit is appreciated to make light air of the situation, but at the same time he's quite serious about this little project. I'm impressed that it compiles at all on my Arch machine, after his warning to Arch users.

On topic to your comment, unfortunately there's no way to avoid leaking traffic information, or at least the fact that there is traffic at all, to a "global passive attacker" :) gone are the days of radio silence

Re:Adam Langley's Pond: Secure Async Messaging by kragen on Sunday July 14, 2013 @03:50AM (#6040275)
There's a paper from the 1990s (https://gnunet.org/sites/default/files/10.1.1.43.4892.pdf I think, Pfitzmann 1991) on building an ISDN MIX for anonymous real-time voice traffic. ISDN gives you two 56kbps or 64kbps channels in each direction for voice, which you can connect to whoever you want. So you just keep these channels open to somebody all the time and keep them full of data, even if it's nonsense. Using fully isochronous streams in this way, assuming a fully connected directed graph, which is overwhelmingly probable, it's impossible for a global passive attacker to determine anything at all about who is actually talking to whom, or how much; the traffic pattern simply is not affected by the communication graph.

A thing I don't know is whether Pfitzmann et al.'s scheme held up to subsequent analysis. I haven't even read the whole paper, actually.

Re:Adam Langley's Pond: Secure Async Messaging by 837 on Monday July 15, 2013 @09:18AM (#6045297)
Can you give a step-by-step advice for installing on Arch Linux? TIA!