Dhole Moments
soatok.blog
Actively hiring
Information Security
As featured in
Follow
Overview
News
Salaries
Products
People
Growth
Offices
Financials
Overview
What's This All About? Hiya, my name is Soatok! I'm a member of the furry fandom. My fursona is a dhole (Cuon Alpinus). You can learn more about my fursona here. My pronouns are he / him. You can find me on the Fediverse (@[email protected]). What's the Point of this Blog?
News
The Long Tail of Work Left Until ActivityPub Has E2EE
Separate from my proposal for key transparency for the Fediverse (which I've certainly blogged about a lot), the W3C has been working on building out end-to-end encryption (E2EE) for ActivityPub. The two projects are mostly being developed independent of
Read more
Report
Soatok's Informal Guide to Threat Models
After a long day of exhausting conversations about Hybrid Post-Quantum Cryptography, random jackasses trying to play gotcha with endpoint attacks against end-to-end encrypted messaging apps, and message board discussions in the wake of dumb politicians pu
Read more
Report
Soatok Dreamseeker Megaplex (@[email protected])
13.3K Posts, 2.23K Following, 8.54K Followers He/him. Gay/demi dhole (Cuon Alpinus) furry.Blogger, programmer, security engineer, cryptography nerd. 30+Too spicy for Twitter (banned with all the prominent journalists on 2022-12-16)I don't represent any co
Read more
Report
Hybrid Constructions: The Post-Quantum Safety Blanket
The funny thing about safety blankets is they can double as stage curtains for security theater. Art: CMYKat "When will a cryptography-relevant quantum computer exist?" is a question many technologists are pondering as they stare into crystal balls or ent
Read more
Report
Cryptography Engineering Has An Intrinsic Duty of Care
To understand my point, I need to first explain three different cryptography attack papers / blog posts. I promise this won't be boring. Three Little Disclosures Misuse-Prone Ciphers For All In a blog post titled Carelessness versus craftsmanship in crypt
Read more
Report
Cryptographic Issues in Matrix's Rust Library Vodozemac
If you're reading this after Matrix's blog post, make sure you read the addendum to this one. Two years ago, I glanced at Matrix's Olm library and immediately found several side-channel vulnerabilities. After dragging their feet for 90 days, they ended up
Read more
Report
Is End-to-End Encryption Optional For Large Groups?
One of the recent topics in Messaging App Discourse is whether it makes sense to prioritize End-to-End Encryption (E2EE) when searching for an alternative to Discord. Who's Saying "No"? I'm going to quote 0xabad1dea here, because she is awesome and explai
Read more
Report
On Discord Alternatives
Next month, Discord is going to start requiring age verification. The backlash from gamers everywhere has been predictable and justified. I guess their company name checks out. https://www.youtube.com/watch?v=D-s6HuzZRNg I've had a few people reach out to
Read more
Report
Software Assurance & That Warm and Fuzzy Feeling
If I were to recommend you use a piece of cryptography-relevant software that I created, how would you actually know if it was any good? Art: Wayward Mutt Trust is, first and foremost, a social problem. If I told you a furry designed a core piece of Inter
Read more
Report
Practical Collision Attack Against Long Key IDs in PGP
In response to the GPG.Fail attacks, a Hacker News user made this claim about the 64-bit "Long Key IDs" used by OpenPGP and GnuPG, while responding to an answer I gave to someone else's question: OK, to be clear, I am specifically contending that a key fi
Read more
Report
Show more news