Tobias Pulls

Computer security and privacy, lately focused on traffic analysis. Researcher at @kaucs, member @torproject, member @dfri_se. I mostly like and retweet.

[Tobias Pulls @tpulls]

Posted some technical details on DAITA v1 and v2 defenses together with @mullvadnet to celebrate the broad deployment of v2 🚀

[Caleb Gross @noperator]

https://t.co/gOSvgSg8kv

[Mullvad.net @mullvadnet]

On Friday the 15th of May, we became aware of a fingerprinting issue affecting Mullvad users.

We have a method which changes this behaviour currently being tested, with plans to begin rolling it out to our VPN servers in the coming weeks.

Read more here: https://t.co/MH32Odwrj0

[Matthew Green @matthew_d_green]

The point here is that this dynamic sucks for users who want an open internet. All of these fights have the effect of pushing forward the age verification and Internet Balkanization legislative agenda.

[Richard Sutton @RichardSSutton]

The bitter lesson in 26 words:

Don’t be distracted by human knowledge, as AI has been historically.
Instead focus on methods for creating knowledge that scale with computation, like search and learning.

[Sebastien Bubeck @SebastienBubeck]

Maybe math papers could include a "Kolmogorov Appendix" with the minimal prompt (or sequence of prompts) needed for an AI to rediscover the proof? With proper rules this could lead to nice explainable blueprint of the paper novelty! (Could have variants for low/high thinking too)

[CR1337 @CR1337]

Statement from Mullvad Co-Founder regarding the issues with exit IP's as fingerprinting vector:

"As for mitigation, we are already testing a patch of the unintended behavior on a subset of our infrastructure."

[Thomas G. Dietterich @tdietterich]

Attention @arxiv authors: Our Code of Conduct states that by signing your name as an author of a paper, each author takes full responsibility for all its contents, irrespective of how the contents were generated. 1/

[Thomas G. Dietterich @tdietterich]

Examples of incontrovertible evidence: hallucinated references, meta-comments from the LLM ("here is a 200 word summary; would you like me to make any changes?"; "the data in this table is illustrative, fill it in with the real numbers from your experiments") end/

[Joel Eriksson @OwariDa]

Extremely concerning

It's all connected. Age verification requirements, chat control, banning VPNs and E2EE in general, cracking down on privacy wallets and coins, moving towards a "cashless" society, biometric passports and requiring fingerprints to enter a country, KYC requirements on stablecoins, hardware-based attestation requirements

What used to be seen as a violation of basic human rights, when performed by authoritarian governments, is now increasingly seen as the "new normal" in the west

And of course, there's the useful idiots believing and repeating the false pretenses regarding that all of this ultimately has anything to do with "protecting the children" and any of the other common excuses

It's about control and surveillance at a scale never seen before, and considering the extent to which it's already been done in the past that's saying quite a lot

You may or may not be comfortable with the current government in your current jurisdiction having access to any and all forms of communication you ever engage in & every type of financial transaction you ever perform, and extensive profiling based on that

But even if you are, do you also trust any future government and person in a position of power, as well as their ability to keep the systems that are used to monitor you and every move you make secure from any and all adversaries that you don't want to have this power over you

[Halvar Flake @halvarflake]

The world would be a better place if more western leaders read what @arunninghacker writes in his substack post.

[Matthew Green @matthew_d_green]

We know this is a risk, because nation-state hackers recently compromised huge portions of the US’s telecom infrastructure. How did they do it? They compromised the “wiretapping” systems that law enforcement uses for investigations. The FBI’s proposed fix? Use secure messaging!

[Matthew Green @matthew_d_green]

Of course this is a very niche technical criticism. More generally, ghost users are a security disaster in waiting. These encrypted messaging apps are literally the last secure systems we have on planet Earth. Backdoor/ like this will be a massive invitation to hackers. 9/

[Lyudmyla Kozlovska 🇪🇺🇺🇦 @LyudaKozlovska]

At a time of constant cyberattacks, EU institutions should defend VPNs as essential tools for online safety, free expression, and secure communication — not echo authoritarian talking points against encryption.

Digital privacy is human rights infrastructure. Strip it away, and the rest follows.
@EP_EPRS @EP_Justice

[Trita Parsi @tparsi]

En gång i tiden stod Sverige för det här och hade ledare av den här kalibern…

[Olivier🐿️ @gloupin]

VPNs are not only important for citizens. But they are an essential part of the cybersecurity of companies, administrations...

Touching VPNs mostly means capitulating against foreign surveillance...

[Matthew Green @matthew_d_green]

There’s something ominous about the speed with which the entire world has marched to require identification on platforms and, as I expected, begin the process of banning anonymous VPNs.

[Bart Preneel @bpreneel1]

As predicted: someone decides that age verification is the best way to protecting children; this starts with mandatory age verification (for everyone!) and ends with banning VPNs and massive blocking. The slippery slope experts have been warning for.

[Signal @signalapp]

A response to recent reporting in Germany, in service of clarity and accountability:

First, it’s important to be precise when it comes to critical infrastructure like Signal. Signal was not “hacked” — in that our encryption, infrastructure, and the integrity of the app’s code was not compromised.

However, sophisticated attackers have engaged in a harmful phishing campaign, posing as “Signal Support” by changing their profile display name and using social engineering to trick people into handing over their credentials — information that allowed these attackers to take over some targeted Signal accounts. This is something that plagues any mainstream messaging app once it reaches the scale of Signal, but we know how high the stakes are given the trust people place in us.
In the coming weeks, you’ll see us rolling out a number of changes to help hinder these kinds of attacks.

Because we don’t collect user data, what we know about these attacks comes from the victims of phishing. And from what victims have told us, the attacks followed a broad pattern: after tricking people into revealing their Signal credentials, attackers then used those credentials to take over their account and also frequently changed the associated phone number. Because such a change results in de-registering your Signal accounts, attackers prepared people for this by telling them that being de-registered was intended behavior, and that all they would need to do is “re-register,” or, create a new account. When they moved to create a new Signal account — one that was now decoupled from their hijacked account — the victims thought they were logging back in to their primary account. As a result, many didn't notice the takeover. The compromised accounts were then weaponized to target the victims' contact lists by posing as the owners of the account.

We understand the trust that people put in Signal, and how devastating this kind of social engineering can be. While it’s true that all messaging platforms are susceptible to scammers and phishing that betrays people’s trust and convinces them to “unlock the front door” where no backdoor exists, we are looking to do everything we can to help people avoid and detect such scams.

For the time being, please stay vigilant against phishing and account takeover attempts. Remember that no one from Signal Support will ever send you a message request or ask for your registration verification code or Signal PIN. For an added layer of protection, you can enable Registration Lock in your Signal Settings (Account -> Registration Lock).

[Thomas H. Ptacek @tqbf]

"Replacing long-lived keys with ephemeral keys is, for my money, one of the best uses of security engineering effort." is the best sentence I've read pertaining to my field in awhile. More at:

https://t.co/HY8WhrYJjp

[Thomas H. Ptacek @tqbf]

This is the greatest TLS video ever made and it just gets better as it goes, it's like a cryptographic version of those insane Bobby Fingers modeling videos.

https://t.co/Cb5Mmz3bq3