roeslpa.bsky.social
Assistant Prof. for Real-World Cryptography at FAU Erlangen-Nürnberg. Worked at NYU, TU Darmstadt, and Ruhr Uni Bochum before. https://roeslpa.de
👤 Joined on 25 October 2023
Followers
Following
Total Posts
@roeslpa.bsky.socialUsable security is a thing; to enforce key verification in a direct way is to force people to perform a ceremony that they do not understand and that creates friction for them. Which changes in no way the fact that key verification should happen. No argument about that.
Show PostThis seems to use a number of non-standard definitions, making Olivd look better why making the other applications look worse. Signals safety number provides e2e auth for instance, the UI just doesn't enforce going through a verification step. This chart therefor appears misleading to me.
Show PostWe found a new compression side-channel attack against SSH: if you use port forwarding with terminal sessions, a web attacker+eavesdropper can recover a sudo pwd in a few hundred trials. There is only one compression context for all channels. Accepted at CCS 26, preprint: arxiv.org/abs/2609.07709
Show Post