Dhole Moments

Last month, I attended both DEFCON and Megaplex.

Separate from my proposal for key transparency for the Fediverse (which I’ve certainly blogged about a lot), the W3C has been working on building out end-to-end encryption (E2EE) for ActivityPub.

After a long day of exhausting conversations about Hybrid Post-Quantum Cryptography, random jackasses trying to play gotcha with endpoint attacks against end-to-end encrypted messaging apps, and message board discussions in the wake of dumb politicians pu…

The funny thing about safety blankets is they can double as stage curtains for security theater.

To understand my point, I need to first explain three different cryptography attack papers / blog posts.

If you’re reading this after Matrix’s blog post, make sure you read the addendum to this one.

One of the recent topics in Messaging App Discourse is whether it makes sense to prioritize End-to-End Encryption (E2EE) when searching for an alternative to Discord.

Next month, Discord is going to start requiring age verification.

If I were to recommend you use a piece of cryptography-relevant software that I created, how would you actually know if it was any good?

In response to the GPG.Fail attacks, a Hacker News user made this claim about the 64-bit “Long Key IDs” used by OpenPGP and GnuPG, while responding to an answer I gave to someone else’s question: OK, to be clear, I am specifically contending that a key fi…

If you think about emails as if they’re anything but the digital equivalent of a postcard–that is to say, postcards provide zero confidentiality–then someone lied to you and I’m sorry you had to find out from a furry blog that sometimes talks about applied

(with apologies to Gil Scott-Heron) If you get all of your important technology news from “content aggregators” like Hacker News, Lobste.rs, and most subreddits, you might be totally unaware of the important but boring infrastructure work happening largely

I’m pleased to announce the immediate availability of a reference implementation for the Public Key Directory server.

If you’re in a hurry, head on over to soatok/elliptic-to-noble and follow the instructions in the README in order to remove the elliptic package from your project and all dependencies in node_modules.

Since I have your attention for the moment, I’d like you to ask yourself a question: What is it that drives you in life?

It is tempting and forgivable to believe that we’re in control of our social media experiences.

I have several projects in-flight, and I wanted to write a quick status update for them so that folks can find it easier to follow along.

One of the first rules you learn about technical writing is, “Know your audience.”

In a recent blog post, I laid out the argument that, if you have securely implemented end-to-end encryption in your software, then the jurisdiction where your ciphertext is stored is almost irrelevant.

“Won’t someone think of the poor children?”