@sarahjamielewis@mastodon.social
@sarahjamielewis@mastodon.social avatar

sarahjamielewis

@sarahjamielewis@mastodon.social

Cryptography and Privacy Researcher. Executive Director @ Open Privacy Research Society (https://hachyderm.io/@openprivacy).

Founder @ Blodeuwedd Labs (https://mastodon.social/@blodeuweddlabs)

Building free and open source, privacy-enhancing, surveillance-resisting tech like Cwtch (https://fosstodon.org/@cwtch)

This profile is from a federated server and may be incomplete. Browse more on the original instance.

simon, to random
@simon@simonwillison.net avatar

I'm on a flight and the in-flight WiFi blocks all forms of video

Any ideas how it might be doing that, given HTTPS? My best guess is that it could be filtering out known CDN host names that serve video

sarahjamielewis,
@sarahjamielewis@mastodon.social avatar

@simon though technical sophistication varies, the bigger airlines typically they do some detection based on a combination of IPs/hostnames/SNI (for trivial blocking of youtube/netflix etc.) and fallback to tcp session shaping (e.g. terminating/lowering bandwidth for flows after a certain amount of data is exchanged) for everything else.

sarahjamielewis, to random
@sarahjamielewis@mastodon.social avatar

Perhaps I have simply outgrown some kind of naive idealism, and perhaps some of it is the tendency to view the past through a more generous filter.

But wow is it hard to -find stuff- now. Even stuff I know exists. Hell, even stuff I know I wrote and put out there.

Lost in an ocean of empty words.

sarahjamielewis, to random
@sarahjamielewis@mastodon.social avatar

Getting to the root of it, I think the thing I miss the most about the old internet was the unstated assumption that the people on the other end of the wire were...people who shared similar interests and just wanted to connect.

I think of all the friends I made, the experiences I had that branched from IRC channels / forums / and even twitter in the later days.

Now the main question I find myself asking of anything that comes across my screen is "what is this trying to sell me?"

sarahjamielewis, to random
@sarahjamielewis@mastodon.social avatar

I spent large portions of my early career rearranging binary sequences on a chalkboard, and writing assembler for obscure architectures.

There are parts of my brain hard wired to recognize and align protocol stacks from a visual representation of a signal dump.

It's cute that you think you have to explain how computers work to me.

sarahjamielewis, to random
@sarahjamielewis@mastodon.social avatar

Software request: I'm looking for a tool I can use to manipulate nodes in a graph. Specifically I would like to be able to:

  • Add new nodes to the graph (not a tree)
  • Create multiple distinct edge relationships between nodes (bonus if the tool lets me formalize these edge types)
  • Have nodes contain notes, perhaps be typed
  • Export the graph to a reasonable (text) file format for external processing
  • Explicitly not an image editor or diagram tool.
  • Run on linux / be open source (flexible)
sarahjamielewis,
@sarahjamielewis@mastodon.social avatar

Additional requirements:

  • be able to handle a moderate number of nodes (at least a few thousand)
  • filter nodes by content and/or type
  • calculate subgraphs by edge relationships
  • have a file format that is practical to import into.
sarahjamielewis,
@sarahjamielewis@mastodon.social avatar

A few more notes after answering some questions:

I explicitly want a tool to help me visually modify nodes and edges in a reasonably sized graph.

The modification bit is really key, as it the ability to maintain multiple distinct edges between two nodes.

I want to steer way from diagramming tools because in my experience they don't scale. And I'm not really interested in visualization tools as I already have a workflow for that.

sarahjamielewis, to random
@sarahjamielewis@mastodon.social avatar

"Note that Recall does not perform content moderation. It will not hide information such as passwords or financial account numbers."

The computer, however, will stop you from recording DRM'd content.

Find it fascinating that when faced with drawing safety and security boundaries, the primary beneficiary is not the owner of the device, or the person using it, but random corporations who control the intellectual property rights.

The system doesn't work for you.

sarahjamielewis,
@sarahjamielewis@mastodon.social avatar

I find it equally fascinating that in order to get anywhere near an integrated computing experience in 2024 we apparently need constant recording and transformer models.

No structured file systems, no permission models, no shared stores, no capabilities - just firehose the display output and hope for the best.

sarahjamielewis, to random
@sarahjamielewis@mastodon.social avatar

Lately I've been engaging in low-frequency, in-depth, long form email exchanges with a few people regarding our shared research interests.

Most of these happened organically, but I've got so much joy and utility out of them that I would like to extend an invitation to anyone who would like the same:

If we share research topics (privacy/security/decentralization/search/e-voting etc.) and you would like to send/receive long detailed emails about problems/ideas on your mind then please reach out.

sarahjamielewis, to random
@sarahjamielewis@mastodon.social avatar

There is not much I can say that has not already been said, but I wanted to share these exposures I took last night, and some notes on the experience.

Definitely one of the most amazing things I have ever witnessed.

Aurora: https://sarahjamielewis.com/entry/aurora.html

A long exposure of the aurora as seen from British Columbia, Canada. A bright pink light in the sky with streaks of green emanating from a radiant point. The big dipper/ursa major constellation can be seen on the right hand side with it's tip towards the radiant point.

sarahjamielewis, to random
@sarahjamielewis@mastodon.social avatar

I'm somewhat perplexed by the new SecureDrop protocol - https://securedrop.org/news/introducing-securedrop-protocol/

Specifically: "The server is “untrusted” in the sense [it] learn[s] nothing about users & messages besides what is inherently observable from its pattern of requests, and it should not have access to sensitive metadata, or sender or receiver information"

Seems like a very weak definition of "untrusted", especially when two comparison techniques explicitly attempt to restrict knowledge derived from access patterns.

sarahjamielewis,
@sarahjamielewis@mastodon.social avatar

Further...doesn't the servers ability to produce arbitrary valid ciphertexts (not really forgeries as it's an explicit requirement) allow a range of active attacks against recipients?

I'm not entirely sure of the consequences there, but it seems incompatible with the optimized decrypt-fetch message id (as it allows the server to test and trigger).

Removing the optimization effectively brings you back to download-all and trial decryption (with server forgeries there becoming effectively noise)

sarahjamielewis,
@sarahjamielewis@mastodon.social avatar

The motivation for private server state is "there isn't enough traffic going through the system to provide a reasonable anonymity set to any observer so we want to minimize observers"

Which is reasonable, but then the server is explicitly not "untrusted" - it can perform all the same statistical attacks...you effectively limit the adversary space to the server.

And if so (and you are unwilling to trust the server) then your risk model becomes that addressed by PIR or OMR.

sarahjamielewis,
@sarahjamielewis@mastodon.social avatar

But instead the protocol explicitly allows the server additional capabilities by granting it participation in generated receiver key material (and bloating the ideal communication cost)

Any optimization you make to reduce that cost grants the server additional information. Either making the server trusted in arbitrary ways or compromising one of the desired properties.

sarahjamielewis,
@sarahjamielewis@mastodon.social avatar

The protocol itself is interesting, involving the server in that way has that nice property of hiding valid ciphertexts from all other parties - I feel like I've seen a flow like it before, somewhere, but nothing immediate comes to mind.

I suspect you could probably hack in authentication into that flow somehow which could have useful applications.

But the protocol doesn't feel like it solves the problem? Or rather, the strengths of the protocol don't nicely map to desired properties.

sarahjamielewis, to random
@sarahjamielewis@mastodon.social avatar

I had a chance to sit down and read Tor: From the Dark Web to the Future of Privacy by Ben Collier (@susansegfault) - https://mitpress.mit.edu/9780262548182/tor/

I highly recommend it. I think it captures the history beautifully and its a nice reminder of how these projects play out over decades.

It can be very easy to get caught up in the day-by-day/week-by-week rush/drama/critiques/effort and having a history like this puts that nicely in perspective.

Go read it.

sarahjamielewis, to random
@sarahjamielewis@mastodon.social avatar

Please steal these project ideas: https://sarahjamielewis.com/entry/privacy-projects.html

A list of research/project ideas that I have no time to pursue fully, but which I would be very interested in helping out/mentoring. If any of these sound interesting then please get in touch.

sarahjamielewis, to random
@sarahjamielewis@mastodon.social avatar

People have a right to access and use secure tooling that enables them to leverage modern cryptography.

The alternative is absurd. A demand to deliberately subvert foundational economic infrastructure. A position that should be laughed out of any sensible room.

sarahjamielewis,
@sarahjamielewis@mastodon.social avatar

If, through some twist of fate, the printing press had arrived after the internet we'd be reading op-eds about the dangers of "anonymous reading" and demands for "accountable bookselling"

  • All
  • Subscribed
  • Moderated
  • Favorites
  • •
  • JUstTest
  • tacticalgear
  • DreamBathrooms
  • InstantRegret
  • magazineikmin
  • Youngstown
  • everett
  • anitta
  • slotface
  • GTA5RPClips
  • rosin
  • thenastyranch
  • kavyap
  • mdbf
  • Leos
  • modclub
  • osvaldo12
  • Durango
  • khanakhh
  • provamag3
  • cisconetworking
  • ngwrru68w68
  • cubers
  • tester
  • ethstaker
  • megavids
  • normalnudes
  • lostlight
  • All magazines
    •