tmctmt

23

[tmctmt @tmctmt]

Mullvad exit IPs are surprisingly identifying
https://t.co/JJzrTTG7Uc

[tmctmt @tmctmt]

@h4x0r_dz it's weird because they explicitly promise not to train LLMs on 'customer or researcher data', but that phrasing suggests they don't train on public reports either.

[tmctmt @tmctmt]

To clarify, the issue isn't a lack of encryption for DNS queries. The traffic is already encrypted at the tunnel layer and it stays in Mullvad's intranet. The real issue is that Chrome *thinks* it's insecure, which triggers it to turn off a privacy feature.

[tmctmt @tmctmt]

I was wondering why Chrome was refusing to use ECH on websites where it works just fine in Firefox.

It turns out Chrome only enables ECH if your system DNS server supports DoH. If you use Mullvad, its internal DNS servers are plaintext only.

[tmctmt @tmctmt]

@soft_fox_lad I noticed that deleted pages on bing tend to stick around for much longer compared to google (too bad they removed cached pages), but that's likely a byproduct of bing's (much) smaller global crawling budget

[tmctmt @tmctmt]

people in the replies have never stalked someone online and it shows😔

[alpha @omarsbigsister]

Stop telling me to use duckduckgo IT SUCKS

[tmctmt @tmctmt]

@TResearchoor 15% of users may have a mac user agent, but how many of them are also going to share the same Mullvad bucket? Probably just one.

[tmctmt @tmctmt]

I can confirm that Mullvad's new mitigation (currently available on select servers) indeed fixes the IP position correlation flaw.

[Mullvad.net @mullvadnet]

On Friday the 15th of May, we became aware of a fingerprinting issue affecting Mullvad users.

We have a method which changes this behaviour currently being tested, with plans to begin rolling it out to our VPN servers in the coming weeks.

Read more here: https://t.co/MH32Odwrj0

[tmctmt @tmctmt]

@TResearchoor It lets you rule out 99% of users. You still need a second clue to identify your target from the remaining 1%, but that's a lot different from trying to find them using only that clue across the entire suspect pool.

[tmctmt @tmctmt]

@TResearchoor at which point it's trivial to identify the person you're looking for.

[tmctmt @tmctmt]

@TResearchoor There are only so many Mullvad users on any given website, and that number gets diminishingly small on anything less than social media.

Given enough IP logs, a list of a thousand Mullvad users could conceivably be boiled down to just 3 based on seed range

[tmctmt @tmctmt]

@TResearchoor https://t.co/hZHjYplPp3

It's a tool I made that calculates positions for a set of exit IPs and deduces the seed that produced them, which was mostly unique per Mullvad user.

The mitigation update removed this pattern from the exit IP choosing algorithm, hence the error.

[tmctmt @tmctmt]

The IPs are still assigned deterministically though and afaict they won't change until the pubkey rotates, which is a bit of a bummer.

[tmctmt @tmctmt]

I don't plan on keeping the database up to date, but since Cloudflare is already experimenting with randomly assigned nameservers, there may not be much point in doing so for much longer anyway.

[tmctmt @tmctmt]

Just released a tool for identifying domains under common ownership using Cloudflare nameserver pair correlation (with some historical data support!):
https://t.co/UfVGr5IEPT

[tmctmt @tmctmt]

For those unfamiliar with the technique, this post by Aidan Thomson describes it pretty well:
https://t.co/LkWw1l4TMi

[fox @soft_fox_lad]

A novel-ish means of finding Satoshi, including a website where you can test your own guesses.

All bad writing is by me. Done in collaboration with @tmctmt.

https://t.co/Ijxb6NNavD

If you're interested in funding this, please lmk.

[tmctmt @tmctmt]

@kevincardenasr More or less expected behavior, considering that shared folder links already reveal this info. It just isn’t displayed in the UI for individual files for some reason.

[tmctmt @tmctmt]

neat trick with mediafire: you can reveal uploader names for single files using mediafire[.]com/api/1.5/file/get_info.php?quick_key=file_id_goes_here

[tmctmt @tmctmt]

how it feels to say pwned as a gen z

[Herman.fun @doomscroll_x]

The Millennial falloff will be studied for generations

[tmctmt @tmctmt]

@xcopydotexe - It uses 128-bit XTS-AES by default despite also supporting the 256-bit variant
- You can't change the KDF rounds and it doesn't support stronger KDF like Argon2 (although VeraCrypt only got it very recently too)

[tmctmt @tmctmt]

The worst part about the YellowKey exploit is the sheer number of misinformed people who are unknowingly going to bottleneck their SSD speeds by like 80% after switching to VeraCrypt instead of simply using password-based BitLocker
https://t.co/1SlXwbI28u
https://t.co/3m46ei6qqX

[Lain on the Blockchain @CryptoCyberia]

After this Bitlocker backd- I mean exploit, Veracrypt schizos should be incredibly smug.

A lot has been said on FOSS vs. closed source with regards to security, but for something as solved as OS encryption, FOSS makes most sense, by a lot.

[tmctmt @tmctmt]

@xcopydotexe The pain points with password-based BitLocker compared to VeraCrypt are:
- Microsoft tries to nanny you into using TPM every step of the way if you use the BitLocker manager. You have to familiarize yourself with the manage-bde command to access most functionality