@h4x0r_dz it's weird because they explicitly promise not to train LLMs on 'customer or researcher data', but that phrasing suggests they don't train on public reports either.
To clarify, the issue isn't a lack of encryption for DNS queries. The traffic is already encrypted at the tunnel layer and it stays in Mullvad's intranet. The real issue is that Chrome *thinks* it's insecure, which triggers it to turn off a privacy feature.
I was wondering why Chrome was refusing to use ECH on websites where it works just fine in Firefox.
It turns out Chrome only enables ECH if your system DNS server supports DoH. If you use Mullvad, its internal DNS servers are plaintext only.
@soft_fox_lad I noticed that deleted pages on bing tend to stick around for much longer compared to google (too bad they removed cached pages), but that's likely a byproduct of bing's (much) smaller global crawling budget
On Friday the 15th of May, we became aware of a fingerprinting issue affecting Mullvad users.
We have a method which changes this behaviour currently being tested, with plans to begin rolling it out to our VPN servers in the coming weeks.
Read more here: https://t.co/MH32Odwrj0
@TResearchoor It lets you rule out 99% of users. You still need a second clue to identify your target from the remaining 1%, but that's a lot different from trying to find them using only that clue across the entire suspect pool.
@TResearchoor There are only so many Mullvad users on any given website, and that number gets diminishingly small on anything less than social media.
Given enough IP logs, a list of a thousand Mullvad users could conceivably be boiled down to just 3 based on seed range
@TResearchoor https://t.co/hZHjYplPp3
It's a tool I made that calculates positions for a set of exit IPs and deduces the seed that produced them, which was mostly unique per Mullvad user.
The mitigation update removed this pattern from the exit IP choosing algorithm, hence the error.
I don't plan on keeping the database up to date, but since Cloudflare is already experimenting with randomly assigned nameservers, there may not be much point in doing so for much longer anyway.
Just released a tool for identifying domains under common ownership using Cloudflare nameserver pair correlation (with some historical data support!):
https://t.co/UfVGr5IEPT
A novel-ish means of finding Satoshi, including a website where you can test your own guesses.
All bad writing is by me. Done in collaboration with @tmctmt.
https://t.co/Ijxb6NNavD
If you're interested in funding this, please lmk.
@kevincardenasr More or less expected behavior, considering that shared folder links already reveal this info. It just isn’t displayed in the UI for individual files for some reason.
@xcopydotexe - It uses 128-bit XTS-AES by default despite also supporting the 256-bit variant
- You can't change the KDF rounds and it doesn't support stronger KDF like Argon2 (although VeraCrypt only got it very recently too)
The worst part about the YellowKey exploit is the sheer number of misinformed people who are unknowingly going to bottleneck their SSD speeds by like 80% after switching to VeraCrypt instead of simply using password-based BitLocker
https://t.co/1SlXwbI28u
https://t.co/3m46ei6qqX
After this Bitlocker backd- I mean exploit, Veracrypt schizos should be incredibly smug.
A lot has been said on FOSS vs. closed source with regards to security, but for something as solved as OS encryption, FOSS makes most sense, by a lot.
@xcopydotexe The pain points with password-based BitLocker compared to VeraCrypt are:
- Microsoft tries to nanny you into using TPM every step of the way if you use the BitLocker manager. You have to familiarize yourself with the manage-bde command to access most functionality