• 6 Posts
  • 298 Comments
Joined 2 years ago
cake
Cake day: April 27th, 2024

help-circle

  • So for context, I actually drink, more than I probably should. I have a well stocked home bar, and trying or inventing new cocktails is almost a hobby for me and my partner.

    I also come from a country with a veeeeeeery ingrained alcohol culture.

    I’d still vote for an alcohol ban. Yes this is hypocritical when looking at my current habits. I don’t really have a point here, beyond saying that, even if banning alcohol is unrealistic, drinking alcohol being gone from the world is still a good idea in principle, the same as with tobacco.









  • It always feels like YouTube is double dipping though. Not with what the post is about; that’s either/or, obviously.

    But Google makes a nice profit collecting user data and behavior, and then selling that to advertising companies. That happens regardless of using an adblocker, and I’d be shocked if it doesn’t also happen regardless of YT premium.

    But at the same time, Google also IS an advertising company; they use their user data collection platform to also show ads to users, getting paid again.

    So personally, even if YT wasn’t owned and operated by a shitstain of a capitalist eldritch horror company, I’d still have zero qualms blocking all their ads: they’re making money off of me regardless.





  • Huh - you’re right. I went back to Signal’s X3DH spec because I was sure I was right, but it seems I misremembered how the “prekey bundles” work: Users publish these to the server, allowing (in my original assumption) for the server to just swap them out for a server/attacker-controlled key bundle for each Alice and Bob.

    However, when Alice wants to send Bob an initial message and she gets a forged prekey bundle, Bob will simply not be able to derive the same key and communication will fail, because Bob knows what his SPK private key is, while the server only knows the public key.


  • A compromised server would allow the server to man-in-the-middle all new connections (as in, if Alice and Bob have never talked to each other before, the Server/Eva can MITM the x3dh key exchange and all subsequent communication). That’s why verifying your contact’s signatures out-of-band is so important.

    (And if you did verify signatures in this case, then the issue would immediately be apparent, yes.)

    Edit: I was wrong. See below.