Hacker Newsnew | past | comments | ask | show | jobs | submit | upofadown's commentslogin

From the article:

>Still, some real-world systems continue to use blind-signature, also known as textbook, RSA.

I think those are two different things.


Once you are in the Waymo, why bother getting out just to get on a bus?

In New York, increases in the use of ride services like Uber mostly came from bus and subway riders[1]. If we are being charitable to Google, we might assume that this initiative is intended to reduce the same sort of trend. If we are not being charitable, we might assume that this initiative is intended to encourage current bus riders to expose themselves to the product.

[1] https://www.6sqft.com/mta-says-uber-use-is-the-cause-of-nyc-...


The answer to both of your points is that mass transit is used for most of the travel and the last mile is taxi equivalent. Being unable to do the last mile is a common reason not to take mass transit, so more usable taxi equivalents tends to increase mass transit use. And most directly, taxi equivalents are often significantly more expensive or significantly than mass transit at crossing cities.

Maybe just an artifact of where I live (Los Angeles), but whenever Ive considered taking Waymo to the train station, it's usually easier and often cheaper to take it all the way to my destination. eg right now a Waymo to the train station is $16, then you wait 0-15 minutes to hop on the train, paying an additional $3.50 round trip. I'm pretty pro-transit, but I can't deny that the ipace is a much more pleasant experience than the train (I can play my music, don't have to listen to other people, guaranteed seating, guaranteed AC, fewer undesired encounters with strangers).

Meanwhile, a waymo to a stadium on that same train line is $26. If you're with 1-3 other people, taking Waymo all the way is a no-brainer.


> If you're with 1-3 other people, taking Waymo all the way is a no-brainer.

This is often the case for any mass transit vs personal transit option.

As for home -> taxi -> mass transit -> taxi -> destination; you have to have a pretty short journey on the mass transit for it to reliably work out cheaper to do home -> taxi -> destination, which pretty clearly restricts the pool of people that applies to.


That's an artifact of where you live haha

It makes a lot more sense for Bart. You can go places that don’t even have Waymo service.

Last mile simplicity? Yes absolutely it incentives both ways. People taking mass transit and not Waymo and folks taking Waymo only. That’s ideal imo.

Cost, presumably?

Hard to judge. The bottleneck is the phase of the algorithm where a really big linear system needs to be solved. That takes a lot of communication between nodes. The breakthrough in using GPUs is that there is good communication between nodes[1]. At the scale of 1024 bit RSA the communication might become a bottleneck again.

[1] https://cognition.com/blog/factoring-rsa-260


Is someone providing prize money again? RSA ended the contest in 2007.

Hence the time machine!

Well most people don't verify identity with some sort of physical key. So it doesn't work as an analogy in the first place for signatures...

Unfortunately, in an end to end encrypted messaging system, an identity is denoted by some sort of long number. That is an inescapable fact. Trusting a third party to correctly map, say, a phone number to a cryptographic identity number eventually results in the sort of attacks we have been seeing with phone oriented encrypted messengers recently like WhatsApp and Signal. The PGP people were doing the right thing when they were doing education in the form of key signing parties. That is something the user needs to know.

Anonymous messengers have no real choice and have to use some sort of number for identity. See Briar, Session or Tox for examples.

My comments on Signalgate 1.0:

https://articles.59.ca/doku.php?id=em:sg


> attacks we have been seeing with phone oriented encrypted messengers recently like WhatsApp and Signal

Could you give an example of an actual attack of this kind on Signal? The 'Signalgate' event was someone mistakenly inviting the wrong person to a chat.


Allegedly, Signalgate was caused by Apple helpfully mapping the wrong number to a name. Then Signal mapped that number to the wrong cryptographic identity.

A Third Party Breached The Intercept’s Signal Tip Line and Has Been Soliciting Whistleblowers https://www.dropsitenews.com/p/intercept-signal-tip-line-bre...

Twilio Incident: What Signal Users Need to Know https://support.signal.org/hc/en-us/articles/4850133017242-T...

Russian State-Backed Hackers Intensify Attacks on Signal Messenger Accounts https://thecyberexpress.com/signal-attacks-russian-fackers-t...


Thanks for the rundown.

> Allegedly, Signalgate was caused by Apple helpfully mapping the wrong number to a name.

In what system is Apple mapping numbers to names? The address book is maintained by users. An AppleID? How could that happen? And it would seem to result in many errors before the Signal error.

I thought it was simply caused by someone adding the wrong person to the chat?

> The Intercept

Per that article, the cause is unknown. The speculated cause in the article is that The Intercept somehow lost control of the user id, and Signal recycles user ids. That seems like a bad practice generally and with this predictable consequence, and especially bad for an application people trust with security.

> Twilio

This was Twilio employees caught by a phishing attack. I wonder what more secure, and affordable, options Signal has. Operate their own SMS infrastructure - would that be more secure that Twilio's? Use something besides SMS - would on-boarding become too hard? Stop using phone numbers - they need some spammer and bot filter, so what replaces it?

> Russian State-Backed Hackers

A phishing attack on Signal users, using a QR or link to make the attacker a linked device. That setup seems risky for non-technical users; I wonder how Signal could better secure it.

That and other attacks are described here. The other attacks all require compromising the device on which Signal is installed:

https://cloud.google.com/blog/topics/threat-intelligence/rus...


My article:

2048 Bit RSA and the Year 2030 https://articles.59.ca/doku.php?id=em:20482030

We don't have any way to predict when and if 2048 bit RSA would be factorable at this time. We would need a breakthrough in hardware and/or algorithms. The common estimation that it is equivalent to the difficulty of brute forcing symmetrical 112 bit encryption seems to be based on some sort of straightforward extrapolation. It doesn't take into account the amount of memory required for the poorly reducible matrix reduction step in the currently known best algorithm. That's 10^18 bytes of memory, or a million terabytes, somehow coupled to enough processing power to actually make anything possible.

Even if you accept the 112 bit estimate, that works out to something like 400 thousand years using the Bitcoin network as a reference to what we could reasonably achieve.


Which isn't a very good margin in cryptography, where we usually aim for things like "longer than the universe's lifetime if every atom was a CPU". But RSA is really slow so we have to compromise encryption speed with cracking speed.


What does the speed of RSA have to do with anything?


If you make an RSA key so big it'll take the lifetime of the universe to crack if you turn all matter into cracking machines, it'll also take a day to encrypt anything. This is not true about other algorithms.


This article from 2000 is about estimating what would be required to factor 1024 bit RSA:

A Cost-Based Security Analysis of Symmetric and Asymmetric Key Lengths https://cr.yp.to/bib/2000/silverman.pdf

It was a response to the idea that 1024 bit RSA was under threat at the time.


I note that that extensive list only contains a single death, due to a power failure. Extreme civil disobedience, but not really terrorism.


You can attempt 15 yourself if you want:

https://towardsdatascience.com/where-are-we-with-shors-algor...

If you run it over and over again you will eventually get 3 or 5...


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: