Search content
Sort by
Showing 20 of 314 results by frisco2
Спрашиваю для друга в Москве. Надо менять ежемесячно крипту на фиат (наличкой), объем примерно $500 - $1000 в месяц. Рассмотрю рекомендации только от людей со статусом на bitcointalk.org -- пишите тут или сразу в личку.
You should know that twitter is now full of trash accounts with blue badges. Don't expect an organic audience from those platform influencers anymore.
Any tips on a reasonable way to gain a Twitter audience in less than a year?
Moved topic to "Scam Accusations," thanks.
> By the way, why would someone send $50 to an account with 52k followers only? I think you will have to understand that many people on twitter have more than 52k followers and they might charge you less then $50 for a retweet.
I am only starting looking for marketing, don't really know when I'm being taken for a ride. Thanks for the tip.
Sending.
> By the way, why would someone send $50 to an account with 52k followers only? I think you will have to understand that many people on twitter have more than 52k followers and they might charge you less then $50 for a retweet.
I am only starting looking for marketing, don't really know when I'm being taken for a ride. Thanks for the tip.
If you have a project that needs promoted on the forum or on social media, I handle some marketing. Feel free to send me a pm.
Sending.
Ok, someone on Twitter stepped in and talked to the girl. She apologized and offered to do 2RT for the price of 1 that I paid her. So I told her that once the order follows through I will clear her name.
Also, maybe it's a guy, but I just assumed its a girl based on the photo.
Also, maybe it's a guy, but I just assumed its a girl based on the photo.
This is about account @xiadefi on X / Twitter. She scammed me for $50. Here is a record of our exchange,
I sent her 0.03 ETH as we agreed for a retweet, but instead of performing the task, she demanded another $200.
She also threatened me that if I don't pay, she will use her account with many followers to discredit my account.
I sent her 0.03 ETH as we agreed for a retweet, but instead of performing the task, she demanded another $200.
She also threatened me that if I don't pay, she will use her account with many followers to discredit my account.
Re: Crosspass - a simple way to share passwords, encryption keys, banking info
⭐ Merited by dkbit98 (1)
I don't have g00gle play store installed, so I am getting this error when I try to create password and note:
Yes, I have added alerts to handle the case when Google Play services are either not installed, or Play Integrity returns an error. Even if you install Play Services in the emulator, it won't pass the further checks, since Play Services verifies whether you have a real device (this is called Play Integrity API).
However, I still think you need to have usable option for desktop users...
I found a product that works on the Desktop, and which is similar to Crosspass in concept. It is called Magic Wormhole, and it was created in 2006.
https://github.com/magic-wormhole/magic-wormhole
The fact that it is not widely used is saying something, namely that it is too technical and too real-time.
I also began planning to add a feature to send images, not just text. This is useful if you need to send someone your driving license or a passport photo.
What's the difference from sending image with encrypted email or other encrypted chatting app?This is a summary of advantages of Crosspass stated earlier, and they apply to images as much as text. The difference is that Crosspass enforces key verification as part of the natural flow, via the PIN which looks just like an OTP familiar to users. All other services rely on public keys being managed by an untrusted party (a server). This allows the third party to MITM you at will. The other issue is JavaScript backdoors which become a problem with webmail (ProtonMail), or anything inside the web browser.
Furthermore, if you are sending a Driving Licence or a Passport, most likely the recipient is some clerk in some company. He will not jump through hoops to receive your encrypted image. He will not signup with ProtonMail. And he will not give you his private phone number for Signal or WhatsApp.
Re: Crosspass - a simple way to share passwords, encryption keys, banking info
It might be nice if you can create a Offline App that can be used to import private keys for paper wallets. Imagine if you can encrypt the private key offline, before you use it and when you go online to import it.. then it quickly decrypt it before you import it. (It does not give the hacker the time to capture and use it, before you use it) 
Many people have malware / Clipboard hacks etc... that collect private keys, when you paste it in text ... and if the hacker is fast enough, he or she can exploit that.... but if the private key are encrypted "offline" and then decrypted just before you use it online to import, it will help you to prevent that exploit.
Many people have malware / Clipboard hacks etc... that collect private keys, when you paste it in text ... and if the hacker is fast enough, he or she can exploit that.... but if the private key are encrypted "offline" and then decrypted just before you use it online to import, it will help you to prevent that exploit.
Do I understand correctly that you want to send your paper wallet key to someone else? Further, is it the case that you don't want you or him to use the clipboard?
Does his wallet software have an ability to import a key from a text file?
I can add to Crosspass an ability to save text into a file, or read from file, instead of relying on the clipboard. Does that help you? You can work with files and your phone without Internet or LAN, by USB cable or NFC.
Re: Crosspass - a simple way to share passwords, encryption keys, banking info
The problem is that people do not want to use the encryption. And they also do not need to share passwords, encryption keys and banking info. In the market you can sale only if you have customers.
A sender does not want to use encryption if it puts an out-of-proportion burden on the recipient to learn how to decrypt. I tried to make Crosspass easy on the recipient. It's on the App Store and Play Store, it's free, and as soon as the app opens the user is asked to type the access code to receive a shared note.
There are already services for sharing passwords and text notes. Most of them are web-based and therefore insecure. But the fact that they exist, shows that there is demand.
privenote.com
onetimesecret.com
Found these guys recently: sharepass.com
If you can send a password, you can send anything, because you can Zip files with AES encryption using 7-zip. No special software is needed on the receiving end to unzip.
Re: Crosspass - a simple way to share passwords, encryption keys, banking info
One thing I know that Crosspass has bugs currently:
...
...
Update: I have released a new version of Crosspass for Android that fixes many stability issues it had.
# Oct 9, 2023
- Auto-correction of text when composing notes
- Improved handling of Play Integrity verification
- Fix right-to-left language locale
- Improved handling of no Internet connection
- Bug fixes related to navigation within the app
I have also released an updated version for iOS, which primarily improved the Paste functionality.
I am now handling the case when the sending side has a bad cellular data connection or the sender is offline (e.g. on an airplane flight).
I also began planning to add a feature to send images, not just text. This is useful if you need to send someone your driving license or a passport photo.
If you want to see this take off, you can help by following me on social media:
https://twitter.com/entelecheia_inc
https://www.linkedin.com/company/entelecheia-inc
https://www.facebook.com/crosspassapp
Re: Crosspass - a simple way to share passwords, encryption keys, banking info
The Crosspass app requires a real device, not a simulator. Here is an excerpt from the white paper that explains the reason,
--snip--
--snip--
Although the number is very small, people who use custom Android ROM is likely unable to pass such check.
Once we implement CAPTCHA for the cases when many phones appear to come from the same public IP (I saw this with a Telecom in South America), I can make it that if the device is does not pass the Play Integrity check, the server will also request a CAPTCHA.
Re: Crosspass - a simple way to share passwords, encryption keys, banking info
The Crosspass app requires a real device, not a simulator. Here is an excerpt from the white paper that explains the reason,
Quote
Crosspass verifies device authenticity and throttles accesses by IP address.
The Crosspass API checks Alice’s device authenticity when her device wants to share a new item. For iOS, it relies on the Device Check and App Attest APIs. For Android, it relies on the Play Integrity API.
Verifications are necessary to prevent a sender’s Denial of Service attack on the availability of lookup IDs. (The lookup ID consists of four case-insensitive letters, therefore the maximum number of reserved lookup IDs are less than half a million.) Verifications are also necessary to avoid a recipient’s attack causing too many Push Notifications to senders’ devices.
In future versions of Crosspass, whenever device verification is insufficient to prevent DoS attacks on lookup ID reservation, a CAPTCHA would be shown. This would be limited only to users who have a public IP from which unusually many requests originate.
The Crosspass API checks Alice’s device authenticity when her device wants to share a new item. For iOS, it relies on the Device Check and App Attest APIs. For Android, it relies on the Play Integrity API.
Verifications are necessary to prevent a sender’s Denial of Service attack on the availability of lookup IDs. (The lookup ID consists of four case-insensitive letters, therefore the maximum number of reserved lookup IDs are less than half a million.) Verifications are also necessary to avoid a recipient’s attack causing too many Push Notifications to senders’ devices.
In future versions of Crosspass, whenever device verification is insufficient to prevent DoS attacks on lookup ID reservation, a CAPTCHA would be shown. This would be limited only to users who have a public IP from which unusually many requests originate.
Re: Crosspass - a simple way to share passwords, encryption keys, banking info
Crosspass discussed on Reddit:
https://www.reddit.com/r/crypto/comments/16fntuc/crosspass_a_mobile_app_to_exchange_passwords_and/
Re bugs, I have now hired a QA. Hopefully we will reproduce this bug and will catch new bugs before users do. I plan to release an update by Oct 15.
https://www.reddit.com/r/crypto/comments/16fntuc/crosspass_a_mobile_app_to_exchange_passwords_and/
Re bugs, I have now hired a QA. Hopefully we will reproduce this bug and will catch new bugs before users do. I plan to release an update by Oct 15.
Re: Crosspass - a simple way to share passwords, encryption keys, banking info
Moreover, the id system that you use is actually not very convincing for people because someone could guess a random id and log into someone's account (even if the attempt fails up to 3 times, this is still vulnerable) and this application is paid which for some people is quite annoying .
Please note that Apple is using the same 4 digit code system to end-to-end encrypt your iCloud data, when it is synched with your phone. They are not using OPAQUE, they are using Secure Remote Password (SRP) protocol which is conceptually just like OPAQUE but has an extra leg of communication and does not have a security proof. I could have used SRP too, but I chose to use the newer OPAQUE which is still in an RFC draft, now in 11th iteration.
See page 35,36 of this document, which describes Apple security in 2014:
https://www.apple.com/mx/privacy/docs/iOS_Security_Guide_Oct_2014.pdf
Quote
# Escrow security
iCloud provides a secure infrastructure for keychain escrow that ensures only authorized
users and devices can perform a recovery. Topographically positioned behind iCloud
are clusters of hardware security modules (HSM). These clusters guard the escrow
records. Each has a key that is used to encrypt the escrow records under their watch,
as described previously.
To recover a keychain, users must authenticate with their iCloud account and password
and respond to an SMS sent to their registered phone number. Once this is done, users
must enter their iCloud Security Code. The HSM cluster verifies that a user knows his or
her iCloud Security Code using Secure Remote Password protocol (SRP); the code itself
is not sent to Apple. Each member of the cluster independently verifies that the user has
not exceeded the maximum number of attempts that are allowed to retrieve his or her
record, as discussed below. If a majority agree, the cluster unwraps the escrow record
and sends it to the user’s device.
Next, the device uses the iCloud Security Code to unwrap the random key used to
encrypt the user’s keychain. With that key, the keychain—retrieved from iCloud key
value storage—is decrypted and restored onto the device. Only 10 attempts to
authenticate and retrieve an escrow record are allowed. After several failed attempts,
the record is locked and the user must call Apple Support to be granted more attempts.
After the 10th failed attempt, the HSM cluster destroys the escrow record and the
keychain is lost forever. This provides protection against a brute-force attempt to
retrieve the record, at the expense of sacrificing the keychain data in response.
iCloud provides a secure infrastructure for keychain escrow that ensures only authorized
users and devices can perform a recovery. Topographically positioned behind iCloud
are clusters of hardware security modules (HSM). These clusters guard the escrow
records. Each has a key that is used to encrypt the escrow records under their watch,
as described previously.
To recover a keychain, users must authenticate with their iCloud account and password
and respond to an SMS sent to their registered phone number. Once this is done, users
must enter their iCloud Security Code. The HSM cluster verifies that a user knows his or
her iCloud Security Code using Secure Remote Password protocol (SRP); the code itself
is not sent to Apple. Each member of the cluster independently verifies that the user has
not exceeded the maximum number of attempts that are allowed to retrieve his or her
record, as discussed below. If a majority agree, the cluster unwraps the escrow record
and sends it to the user’s device.
Next, the device uses the iCloud Security Code to unwrap the random key used to
encrypt the user’s keychain. With that key, the keychain—retrieved from iCloud key
value storage—is decrypted and restored onto the device. Only 10 attempts to
authenticate and retrieve an escrow record are allowed. After several failed attempts,
the record is locked and the user must call Apple Support to be granted more attempts.
After the 10th failed attempt, the HSM cluster destroys the escrow record and the
keychain is lost forever. This provides protection against a brute-force attempt to
retrieve the record, at the expense of sacrificing the keychain data in response.
In summary, Apple considers 4 digits to be secure enough, just like a bank.
When you argue that a 4 digit PIN is too short, are you arguing that a conventional password in its place would also be too weak? In that case, you are challenging the security of SRP and OPAQUE protocols, not merely Crosspass.
If you are not comfortable with 4 digits, then you can transfer 3 random keys, then combine them (by e.g. SHA or XOR) to get a new key. This way you increase the difficulty of guessing to a 12 digits password. That's 11.5 x 3 = 35 coin flips which the MITM must guess in 1 attempt. Using Crosspass 3 times in a row, is still easier than PGP or Diffie-Hellman.
If you want an open source tool implementing OPAQUE, my patent would not stop you. My patent, in fact, does not limit to OPAQUE use, but says that any PAKE (Password Authenticated Exchange) can be used. So what is my innovation then, and why was I given a patent? My innovation is that I put it into a mobile phone form-factor. From the patent's abstract,
Quote
This invention enables asynchronous encrypted communication under a protection of a simple password which must be communicated out-of-band. The password is easily communicable in-person, by telephone or by a text message. The invention assumes that one of the parties has an online device, such as a smartphone. After the encrypted session has been established, it can be used for a variety of cryptographic applications, such as encrypting or decrypting messages, sharing of cryptographic keys, and verifying data. The invention also has the secondary benefit of authenticating both parties to each other.
About the bugs:
One thing I know that Crosspass has bugs currently:
- Crosspass is still Beta.
- The iOS version is more stable than the Android version.
- We are working on the bug found by @dkbit98 to improve error message, so that we can see what actually happened (I suspect it was related to app permissions).
- Known bugs are likely UI only and have no security implications. The encryption itself is implemented in Go and is plugged into both iOS and Android apps as a library. Doing it this way allows to test the encryption offline, outside the app by unit tests.
Re: Crosspass - a simple way to share passwords, encryption keys, banking info
Most notably the fact that it is a black box for the user what happens under the hood. Too much trust required. For me to ever consider something like this, it would have to be open source.
If I wanted to share private information, I would likely use OnionShare which is open source and rather easy to use.
If I wanted to share private information, I would likely use OnionShare which is open source and rather easy to use.
If you want an open source tool, then you can use this free Diffie-Hellman exchange tool I made three years ago. It is a webpage that can be run locally as `file://` to protect from Javascript backdoors. Simply use "Save As (Webpage, Complete)" in the browser and save it. It's designed to be run locally. The code is simple to review fully, since it merely wraps browser's native libraries.
https://borisreitman.com/privacy.html
I have made Crosspass because as simple as that tool is, it is still too difficult for non-techies.
Re: Crosspass - a simple way to share passwords, encryption keys, banking info
That's different than what you said on your website:
Quote
note that the Lookup ID is not secret, so you can make it public without any loss of privacy.
This makes it look like you can post the Lookup ID on social media, while it's something to be kept a secret.By public I meant an insecure channel between two people, but not tweeting it. (If it's tweeted, then some jerk can try to access it with 3 invalid PINs and lock the note.) I have updated the website with a clearer explanation to the question "Do I need to send the PIN by another channel?"
Quote
You can send both the Lookup ID and PIN together. However, if you are communicating over an insecure channel and you need to refer to the share, you can refer to it by the Lookup ID.
For example, Alice writes in an email to her cat sitter Bob:
Quote
Hey Bob,
Thanks again for agreeing to feed my cat Luna. You are a lifesaver!
I am sending you the WiFi password in note XYZC, and the gate code in note QCTY.
You will need to use the Crosspass app to get them. Text me when you are at the gate.
Feel free to hang out at my place, Luna could use the company.
Hugs,
Alice
Thanks again for agreeing to feed my cat Luna. You are a lifesaver!
I am sending you the WiFi password in note XYZC, and the gate code in note QCTY.
You will need to use the Crosspass app to get them. Text me when you are at the gate.
Feel free to hang out at my place, Luna could use the company.
Hugs,
Alice
Then, once he arrives at the gate and texts her,
Quote
I am at the gate and I have Crosspass. What’s the PIN?
She texts him,
Quote
XYZC 1935
QCTY 0382
QCTY 0382
Re: Crosspass - a simple way to share passwords, encryption keys, banking info
Again: I'd much rather trust Protonmail than installing unknown software. If Protonmail ever compromises their core principles, they won't survive.
Lavamail chose to shutdown instead of fooling its users and keep silent under a gag order. It was a USA corporation. Can't this happen in Switzerland? I think it can, because USA forced Swiss banks to close American accounts and to reveal all account activity to American authorities.
Also, as much as I value privacy, I value and respect the judicial system. The reason? Civilized society is setup to protect privacy, at least in principle. So if police wants data on someone and they come to me with a court order, it is my principle to respect the law and to comply with the request. However, if I simply can't help because of the way the protocol is implement, I do well by both the law and by privacy of clients. In contrast, Protonmail, Signal, WhatsApp, et. al. could MITM any user by issuing rogue public keys. Crosspass is safer because in order for the Crosspass server operator to MITM a client, he would have to guess the PIN, which is as hard as guessing 12 coin flips.
Quote
The difference is that a bank also requires a piece of hardware to go with the PIN. If the Lookup ID is public, that's like handing out your bank card to random strangers to try their luck.
What's the difference, if in total only three attempts are permitted? Does it matter which three people use up these attempts? The bank is happy with a 4 digits PIN because it can limit the number of attempts. Long passwords are needed only when a brute force attack cannot be prevented (when password hashes are leaked).
Crosspass is relying on the OTP model for authentication. In common usage OTPs are short and yet they unlock a person's account. Why is this safe? The time limit on the OTPs prevents theft through shoulder surfing or internet traffic harvesting. The limit on tries prevents brute forcing. (You can achieve the former with Crosspass by deleting a share after 5 minutes.)
Quote
If you've installed malware, it's safe to assume it's still there after you try to delete it. That's why I don't like installing unknown software outside a controlled environment (such as a VM or spare laptop). I've setup my spare laptop to wipe and reinstall it in minutes, and I use this when dealing with untrusted Forkcoin wallets. I can't do that on my phone, and even spare phones are less easy to properly wipe and use again.
I understand this, but the recipient to whom your are sending sensitive stuff most likely will not. It takes two to tango. If the recipient is a busy accountant, realtor, or a lawyer, he will not do all this work. So if we are to have any adoption of secure practices, we need to package it in a form-factor they will use without friction.
The other issue is: are you willing to keep your laptop online until you establish a shared key by Diffie-Hellman? The choice to put Crosspass on a smartphone was made because it is always online, like a personal server in a pocket. Twenty years ago people kept their desktops online, serving a website from it. With the prevalence of laptops this ended while computers which are always online had moved to the cloud.
Quote
The problem is still the same: there will be a 3 in a million chance for someone to find the private key I sent. That's an unacceptable risk.
- Not just any someone, it would have to be someone who is a MITM. Otherwise, you will know the key was stolen if your friend has not received it. Crosspass will release the shared secret only once, and expire the PIN.
- Then send a public key, not a private key: establish a private key by Diffie-Hellman (DH) and verify the public keys by Crosspass to ensure that there was no MITM in the Diffie-Hellman exchange. (You can do this in practice with the Signal app by sending Signal's Safety Numbers by Crosspass.)
In any case, if you do transfer a private key by Crosspass and it is used to initialize a Signal protocol chat, then one chat round (e.g. "Hello Alice" and "Hello Bob") are sufficient to establish a new Diffie-Hellman key, essentially using the original private key only for authentication.
Quote
I've never used Google's app payment system, and I never will. Again, I guess I'm not the average user here, but I refuse to pay for small pieces of software on a small screen when I have complete open source operating systems with loads of software at my disposal free of charge.
Crosspass one day will be a free of charge CLI which you can install with Apt or Brew, from source. That will cover the cool cats, but what about laymen? As mentioned above, most other people who receive or send stuff to you will not be able to use it in this form.
End-to-end encryption was almost non-existent in adoption until WhatsApp. In order to make encryption habitual, it must be put into a form that everyone can use. This was my design goal with Crosspass.
Re: Crosspass - a simple way to share passwords, encryption keys, banking info
Quote
Can we pay this $1 with Bitcoin or only with fiat currencies?
Apple and Google do not allow this for mobile apps. They also don't allow cheating (i.e. charging off the app and then using some kind of coupons). But if they will eventually add a feature to pay for in-app purchase by crypto, then you will be able to.
This won't be an issue when Crosspass is released as a desktop app, and in this case it would accept directly a crypto payment.
Quote
If I had to receive Bitcoin address from someone and this guy told me that first I have to install new app on my phone, I would immediately think that this guy is a scammer.
I have seen way to many real life cases of people getting scammed like this with fake apps, so I would probably refuse to install anything.
I have seen way to many real life cases of people getting scammed like this with fake apps, so I would probably refuse to install anything.
This happens rarely in iOS and with time Play store will up its game.
Quote
There is a chance I would use something like this if Crosspass was integrated in some messenger used for private conversation.
Yes, I am also exploring this direction. But the standalone app will continue to exist in any case.
Re: Crosspass - a simple way to share passwords, encryption keys, banking info
I was hoping the site itself would be enough, but it asks me to install software on my phone.
End-to-end encryption in web browser is not possible. Protonmail, Hushmail etc. are subject to Javascript backdoors. Hushmail actually backdoored itself and documented it. https://www.wired.com/2007/11/hushmail-to-war/
This is a lot more complicated than using Protonmail to send an password to another Protonmail user. Protonmail uses end-to-end encryption by default without sending codes and passwords, and can also set an expiration time.
Besides the web issue, the same critique I have in the FAQ on WhatsApp applies to Protonmail. You have to trust the public key that Protonmail gives you for the recipient, and so it can easily position itself as a MITM. That, unless you check key fingerprints against the recipient's. But if you have to do this, it is no longer an easy process. (How would you check them? You would need something like Crosspass for that.)
Quote
..
If I really, really have to share something encrypted online, I'd prefer Protonmail.
...
If someone tells me to install an app to receive a code, I'll tell them to use something else. I don't even install apps from my bank.
If I really, really have to share something encrypted online, I'd prefer Protonmail.
...
If someone tells me to install an app to receive a code, I'll tell them to use something else. I don't even install apps from my bank.
Yet, you would expect the recipient to sign up with Protonmail? I think that a recipient is more likely to install an app than create an account online somewhere. He knows that he can easily delete it as soon as he is done using it. Also, you would need to wait for the recipient to sign up with Protonmail before you can compose a message to him.
Quote
So if someone knows your Lookup ID, there's a 3 in 10,000 chance they can read your message. I wouldn't trust that for sending a credit card number, and it's much worse when dealing with Bitcoin private keys.
3 out of 10,000 is like 1 out of 3333, is harder than guessing a sequence of 11 flips of a coin. I though that if it's good enough for a bank, it's good enough for Crosspass. I could have made the PIN 6 digits long and it would still be user friendly because OTPs now are commonly a pair of 3 digits. But I am not convinced it's necessary. (If there is real demand for a six digit PIN, I could incorporate it as a future feature.)
Quote
If it's not going to be open source, you can always add a backdoor later.
Every version will be reviewed just before it's published to the App store and Play store. There would not be a need to review everything from scratch, just need to review the changes to source code since previous release.
Crosspass does not compete with WhatsApp, Signal, Telegram Secure Chat or Protonmail, Hushmail. Keep using those systems, but use Crosspass to verify the public keys in order to secure those systems.
Re: Crosspass - a simple way to share passwords, encryption keys, banking info
I know you'll tell me it's safe and that it's "encrypted end to end" But how can I be confident that the program does not store passwords and encryption keys and keep them in the database after sharing them?
As you know there was a major incident related to this particular point and sensitive user data was seized due to it being saved and not deleted.
As you know there was a major incident related to this particular point and sensitive user data was seized due to it being saved and not deleted.
I have just open-sourced the code that deals with persistence of data locally on the phone. All sensitive data is stored in encrypted form. The encryption key never leaves the device because it is stored in Secure Enclave. This is necessary so that the data doesn't leak through iOS / Android recovery backups.
https://github.com/entelecheia-inc/ios-excerpts
https://github.com/entelecheia-inc/android-excerpts
Of course these excerpts do not guarantee that I call these functions consistently, but it will give you an indication of what is going on.
Also, I blank the screen when the app is swiped, so that iOS/Android doesn't grab in the optimization screenshot displayed sensitive text.
@NotATether: I am sending you a PM about arranging the code review.