Surely the TOR protocol is equivalent encryption to SSL/TLS and thus only the exit node or one with the exit node's private key can read any traffic for the hidden service?

TLS works for me going to google.com because a central CA has signed the certificate presented by google.com

Apparently there are directory servers that sign the public keys for each node, mitigating this MITM attack: https://news.ycombinator.com/item?id=6888307

Without those servers, if we assume the NSA owned the network the entire point would be moot. With those servers... I guess the NSA would have to fuck with your Tor client or steal those server's private keys.

It body snatched the octopus and is now wearing it like a skin in search of more prey.

I thought the purpose of TechCrunch was content farming and search engine spamming for startups they have a vested interest in.

> didn't want to rely on anyone except ourselves.

And the remarkably secure telecom system, of course.

Google's style of 2FA is IMO technologically superior in that there is no communication after the initial seed. It also appears to be somewhat standardized -- see others posting about Authy. You could have your own handwritten program running the algorithm if you wanted to be independent.

The real screw up on Google's part is not instructing users to have an encrypted backup of their 2FA data.

Well, they do instruct people to print backup codes.

Arbitrary changes? But then how can we ensure that you are charged the proper price for tethering bandwidth versus phone bandwidth? How can we ensure you are paying the right price to blacklist phone numbers? My goodness what if you remove the default apps from the phone? No, that won't do at all.

The rest of the magazine would be like, "patio11's dos and don'ts of summer SEO", "can lisp trim your application's waistline?", and "infosec schadenfreude! how to protect your app". viz., HN.

My favorite title of all time is Tim Ferriss's "How to Learn but not Master any Language in 1 Hour". All others are merely vying for disingenuous second place. I guess it is all about marketing your blog posts.

I like that. Makes it seem more legitimate but still attention-grabbing.

That's not what you asked, you asked "would you be happy".

Yes, it was a rhetorical question meant to illustrate that there are some things for which it's not evil to publish. Another example would be the names and locations of victims of spousal abuse that are in refuges.

In any case, if you're being that pedantic, why didn't you notice that I actually asked revelation that question, and not DJN?

They define terrorist pretty loosely anyway, so it'd be hard for all "terrorists" to be totally unaffected by the leaks, thus making their statement "true" or, rather, least untrue.

It's infringement and it's fine that the content owners send out their C&D's. I doubt there is any malice, though. I seems more like they just loved the game and want it to continue in some form than they are trying to get attention.

That is the incentive behind all the remakes, but it doesn't change anything. In life, intent doesn't mean much. It can be a slap in the face sometimes as well. Besides, commercial intent is inevitable when they start to grow.

You are not correct on this one. Intent is greatly meaningful in life and under the law. Commercial intent with a derivative work is not inevitable, nor is their growth inevitable.

I agree that intent can be meaningful in a court of law. But try the intent excuse with a woman or in a business transaction and it might not matter. Sure it could, but it's usually the end result that really matters. Intent translates to something along the lines of, "I tried, but something happened and now you're not getting what you expected" -- sounds like falling short to me. I'd much rather just get exactly what is expected and agreed upon.