On 7/5/2023 3:24 AM, Incubus wrote:
> On 2023-07-05, Paul <nospam@needed.invalid> wrote:
>> Is it better than the trivially crackable 40 bit WinZIP stuff ? YES :-)
>> At least, don't use 12345678 for the password, OK ?
>> Another option, is to do the crypto separately.
>
> I think the encryption just needs to be 'good enough' to get past the
> copyright censors for the few days that the file will be on the server.
>
> The only other issue is you don't know what software the recipient uses.
> So whatever encryption is used, it has to work on all 5 systems out there.

Neither of the high-compressors, is a public standard.

Which complicates the ability of others to write decompressors.

Decompressors may be available free (RAR only charges for compressors),
but the platform issue is something else entirely.

WinZIP stands the best chance of being cross-platform, due to its
longevity. But then, is the latest change to it, updated into
all the platforms. That, I don't know. I'm the guy who doesn't
own a smartphone, so those ecosystems remain a mystery to me.

If someone needs a container for distribution, they lean on ZIP
rather than BZ2, 7Z, or RAR. BZ2 is a bit slow on compression.

ZIP is used all sorts of places, but not all of it. Office documents
(.docx) use ZIP inside. Java .jar files are likely ZIP inside. Any time
a file format needs a "container", it seems to get used for that,
but that is likely to be sans-crypto. The backup programs don't
seem to use it, as they prefer something even lighter as a
compressor (speed-transparent).

*******

I seem to remember playing around with GPG perhaps (GNU Privacy Guard?).
I had some tool installed, fed it a couple test cases, and unknown to
me, it ran a compressor on my test file first, then encrypted the file.
(I don't recollect this being documented in the manual. I expected crypto-only.)
And you could specify something like RSA2048 or RSA4096, something like
that. At first, I couldn't figure out what the tool was doing, because
I happened to feed it a file full of zeros for my first test case.
It compressed the hell out of that, in no time flat, and "the screen blinked"
and it was done. And I figured "oh, it must still be running". I couldn't
figure out where the output went, and so on. It's possible something
like that is available on a few platforms. Perhaps the recipient-side
experience will be less-comedic :-)

Paul

On 7/5/2023 3:55 AM, Andy Burns wrote:
> Paul wrote:
>
>> Isn't there an SDK for 7Z ?
>
> There was (presume still is) a command line tool as an add-on for IZarc, not sure if there's a callable API though?

They name the platform supported for the various files here.
A few console versions are available.

https://www.7-zip.org/download.html

Download .7z any / Windows 7-Zip Source code
Download .7z any / Windows LZMA SDK: (C, C++, C#, Java)

Download .tar.xz 64-bit Linux x86-64 7-Zip for Linux: console version
Download .tar.xz 32-bit Linux x86
Download .tar.xz 64-bit Linux arm64
Download .tar.xz 32-bit Linux arm

Download .tar.xz macOS (arm64 / x86-64) 7-Zip for MacOS: console version
Download .exe Windows 7zr.exe (x86) 7-Zip for Windows: console executable

What bothered me a bit, is the Linux version didn't seem to have
the multithreaded compressor and multithreaded decompressor, like
on the Windows version. And that suggests to me, a person who
wants "five platforms" is going to need to test all five of those
for themselves, just in case the experience is rougher than expected.

Paul

Paul <nospam@needed.invalid> wrote:
[...]

[About WeTransfer[.com]:]

> These transfer schemes can't last too long.

WeTransfer exists since 2009, so quite a long time.

<https://wetransfer.com/corporate/about> See the 'History' section.

> Mozilla had one, related to Firefox, and they had to
> shut that down.
>
> They're just too hard to police, and keep the authorities happy.

We're Dutch, we can't be shut down! :-)

FWIW: Yes, I use WeTransfer (once in a while). No, *I* am not 'Arlen'.

On 2023-07-05, Paul <nospam@needed.invalid> wrote:
> WinZIP stands the best chance of being cross-platform, due to its
> longevity. But then, is the latest change to it, updated into
> all the platforms. That, I don't know. I'm the guy who doesn't
> own a smartphone, so those ecosystems remain a mystery to me.

If we assume one third of people on web forums is under 40 while the next
third is over 40, where the third third is us guys over 80, things change.

Those under 40 do almost EVERYTHING on their phones.
Above 40, they use both.

It's only we older ones double that age who shun the tiny phone screens.

I only ran a quick search but, unfortunately, I don't think there is any
unzipper that has a tool on all the five platforms in common use today.

I agree with you on your suggestion of WinZip having the best chance of
being able to be run with encryption all five platforms can decrypt easily.

[1] https://www.winzip.com/en/windows/
[2] (I was surprised that it's apparently not ported to linux)
[3] https://www.winzip.com/en/mac/
[4] https://play.google.com/store/apps/details?id=com.winzip.android
[5] https://itunes.apple.com/us/app/winzip/id500637987?mt=8

But the only platform that didn't have WinZip when I just looked was Linux,
but nobody on Linux will have any problem unzipping a file so that's OK.

It's iOS users who will have the most problems (which is always the case).

I think the only "security" uploaders need is to hide the copyright page.
If they're doing more nefarious stuff, then this is the wrong group to ask.

It would have been nice to find all platforms using the same tool though.

On Wed, 5 Jul 2023 07:36:14 -0000 (UTC), Zaidy036 wrote:

> If you use DropBox access to file can be granted to email addresses.

If you're uploading and downloading from torrents, then there's a chance
that it's copyrighted so using any email address is not the best solution.

People should probably use a vpn, then a killswitch, then a tor browser to
get the magnet, then a bittorrent client to get the torrent, then encrypt
it to hide the content before uploading the encrypted file to the share
sites while still on VPN or at least with a privacy proxy browser and then
communicate the resulting time-expiry share url with the recipients in a
come-and-get-it forum message set up with a throwaway email if possible.

Did I miss anything?

Charles Jack Jones <charliejackjones@cjj.com> wrote in
news:u82mkh$2s44b$1@news.samoylyk.net:

> Minor detail. The GoFile FAQ says the expiry is 10 days
> after the data becomes inactive but that's long enough for
> an individual file transfer. https://gofile.io/faq
>
> For how long are my files available on gofile?
>
> As long as your files are regularly downloaded by different
> users on a weekly basis, they will not be deleted. If a
> file is no longer downloaded, it becomes inactive and is
> subject to deletion after 10 days. If you wish to store
> your files permanently, you may upgrade your account from
> your profile page.

I don't have a problem with expiration...but 10 days sounds a little short.

On 7/5/2023 12:57 PM, Incubus wrote:
> On 2023-07-05, Paul <nospam@needed.invalid> wrote:
>> WinZIP stands the best chance of being cross-platform, due to its
>> longevity. But then, is the latest change to it, updated into
>> all the platforms. That, I don't know. I'm the guy who doesn't
>> own a smartphone, so those ecosystems remain a mystery to me.
>
> If we assume one third of people on web forums is under 40 while the next
> third is over 40, where the third third is us guys over 80, things change.
>
> Those under 40 do almost EVERYTHING on their phones.
> Above 40, they use both.
>
> It's only we older ones double that age who shun the tiny phone screens.
>
> I only ran a quick search but, unfortunately, I don't think there is any
> unzipper that has a tool on all the five platforms in common use today.
>
> I agree with you on your suggestion of WinZip having the best chance of
> being able to be run with encryption all five platforms can decrypt easily.
>
> [1] https://www.winzip.com/en/windows/
> [2] (I was surprised that it's apparently not ported to linux)
> [3] https://www.winzip.com/en/mac/
> [4] https://play.google.com/store/apps/details?id=com.winzip.android
> [5] https://itunes.apple.com/us/app/winzip/id500637987?mt=8
>
> But the only platform that didn't have WinZip when I just looked was Linux,
> but nobody on Linux will have any problem unzipping a file so that's OK.
>
> It's iOS users who will have the most problems (which is always the case).
>
> I think the only "security" uploaders need is to hide the copyright page.
> If they're doing more nefarious stuff, then this is the wrong group to ask.
>
> It would have been nice to find all platforms using the same tool though.

Linux has Archive Manager and the base of that would be "zlib" or so.
There has likely been a library for that, for some time.

*******

I like the Apple link.

The promo material sez:

Whether you receive a Zip, Zipx, 7z, RAR or LHA file as an email attachment,
or want to extract download and view the contents of a
Zip, Zipx, 7z, RAR or LHA file from the web, just “Open with WinZip”.

Then, one of the reviews sez:

Even though it’s 2023 and everyone uses zip now, someone gave me a .7z file,
so I thought I’d try this to extract it. “Extract” immediately froze the app.
“Extract to here” gave me a loading bar that was stuck at zero and the
app still froze when I tried to cancel it several minutes later.

It all sounds so normal.

I would be willing to bet, the file was encrypted, and
what was supposed to happen is a dialog was supposed to show,
asking for a password.

if the reviewer had tested a WinZIP file with AES256 protection,
there would likely be a dialog box (because the developer
has precise control of their own libraries). At least some
of the foreign formats, the support path for those
might be different.

Paul

On 7/5/2023 11:24 AM, Frank Slootweg wrote:
> Paul <nospam@needed.invalid> wrote:
> [...]
>
> [About WeTransfer[.com]:]
>
>> These transfer schemes can't last too long.
>
> WeTransfer exists since 2009, so quite a long time.
>
> <https://wetransfer.com/corporate/about> See the 'History' section.
>
>> Mozilla had one, related to Firefox, and they had to
>> shut that down.
>>
>> They're just too hard to police, and keep the authorities happy.
>
> We're Dutch, we can't be shut down! :-)
>
> FWIW: Yes, I use WeTransfer (once in a while). No, *I* am not 'Arlen'.
>

If the WeTransfer is free, how is the bandwidth paid for ?

The site I use to post photos, their bandwidth bill per month, is $30,000 .
That's why you ask the question, how some of these services are supported.
Real, significant, sums of money are involved.

At one point, my photo site "lost" its domain. An American takedown
at a guess. I would not make too many "proud declarations" if I were you.
It could be, there is an unlocked door on the side of the WeTransfer
site, and some unsavory individuals enter via that door. And I'm not
talking about the cleaning staff either.

Paul

On 7/4/23 11:48 PM, Falafel Balls wrote:
> On 5/7/2023, Nic wrote:
>
>>> Though you could also use google drive, which is 5gb free. Onedrive
>>> likely does something similar too for free version.
>> Amazing, another knuckle head falls out of the trees.
> Doubt google drive or one drive are viable given the question & ngs.
> Also probably safe to assume files need to be protected with a password.
>
> Which is perhaps why the op omitted google anything and which means the OP
> will likely be posting the uri's to a suitable forum in some anonymous way.
>
> Given basic normal privacy/anonymity assumptions, encryption will be needed
> for the file where the decryption by unknown users is the problem to solve.
>
> Android, being linux, has many tools that will open all protected formats.
> https://play.google.com/store/apps/details?id=com.rarlab.rar
> https://play.google.com/store/apps/details?id=com.sociosoft.unzip
> https://play.google.com/store/apps/details?id=ru.zdevs.zarchive
>
> For ios the files tool will open zip files but it won't open rar files.
> But the documents tool many ios users already have does open rar files.
> https://apps.apple.com/app/documents-file-manager-app/id364901807
>
> For the iphone, other good third-party tools might be zip or izip.
> https://apps.apple.com/us/app/zip-rar-file-extractor/id769409043
> https://apps.apple.com/us/app/izip-zip-unzip-unrar/id413971331
>
> Overall probably the best single free tool on all the platforms is winzip.
> https://www.winzip.com/en/all-products/
Google must be driven off the digital stage, in order for the internet
to survive. Google will scrape every bit of information in order to own
you and every thing you think you are. Stop using Google, starve out the
beast, and when the beast gets very hungry it will take risks.

On Wed, 05 Jul 2023 18:15:00 +0000, DanS wrote:

>> For how long are my files available on gofile?
>>
>> As long as your files are regularly downloaded by different
>> users on a weekly basis, they will not be deleted. If a
>> file is no longer downloaded, it becomes inactive and is
>> subject to deletion after 10 days. If you wish to store
>> your files permanently, you may upgrade your account from
>> your profile page.
>
> I don't have a problem with expiration...but 10 days sounds a little short.

I guess there are two answers to that, in that I would agree ten days is,
well, it's only a week and a half - which is short but it's probably "long
enough" if you are sending a link to someone in a web forum to get a file.

Also, the way it's worded, I think it's not ten days but ten days after
different IP addresses are downloading the file from your link.

If you're clever about it, every nine days you can pop onto another VPN and
download it yourself - but that seems kind of labor intensive to extend it.

Luckily the other one that was suggested has a user-settable expiry date.

How many were suggested so far anyway?
About a half dozen to a dozen?

Which is best?

On 6/7/2023, Nic wrote:

>> Overall probably the best single free tool on all the platforms is winzip.
>> https://www.winzip.com/en/all-products/

> Google must be driven off the digital stage, in order for the internet
> to survive. Google will scrape every bit of information in order to own
> you and every thing you think you are. Stop using Google, starve out the
> beast, and when the beast gets very hungry it will take risks.

For people on this newsgroup, they're informed enough to know that using
Google is not the most private way to do anything - whether that's email or
an Internet drive or a mapping program or a search engine - or whatever.

That's to say that nobody who is intelligent on this newsgroup uses it
(at least not without knowing that they're trading their privacy away).

However...

There are plenty of mom and pop types of people who know nothing about
computers who find these Google (and Apple & Microsoft) solutions fine.

Those people who know nothing about anything are happy to use these three
(we can probably add DropBox as a fourth in this file sharing regard).

What the big three (or big four) do for the average clueless mom and pop
user is they make it *easy* to share files without having to think of it.

That not-wanting-to-think attitude of clueless people is what they do.

So you do not need to preach here about the "evils" of the big three
(Google, Apple & Microsoft). You need to preach to the avg mom & pop.

But they're not on this newsgroup.

Almost nobody on this newsgroup would use the big three for file sharing.

On 2023-07-05, Paul <nospam@needed.invalid> wrote:
> I like the Apple link.
>
> The promo material sez:
>
> Whether you receive a Zip, Zipx, 7z, RAR or LHA file as an email attachment,
> or want to extract download and view the contents of a
> Zip, Zipx, 7z, RAR or LHA file from the web, just "Open with WinZip".
>
> Then, one of the reviews sez:
>
> Even though it's 2023 and everyone uses zip now, someone gave me a .7z file,
> so I thought I'd try this to extract it. "Extract" immediately froze the app.
> "Extract to here" gave me a loading bar that was stuck at zero and the
> app still froze when I tried to cancel it several minutes later.
>
> It all sounds so normal.

Yeah, you gotta take them with a grain of salt.

Thanks for looking that one up as I didn't delve that deeply into it.

Normally this group wouldn't deal with the iOS users (except when someone
who doesn't know they're - well - they're just kind of different but they
unknowingly put them on the newsgroup list and always - predictably - all
hell breaks loose as the iOS users are different in that they can't stand
when anything is said about Apple that Apple didn't tell them to say).

It's like how this July 4th Gabriel Iglesias video clip posted two days ago
at one minute explains a Pepsi commercial being well marketed but it
doesn't deliver what it marketed. https://youtu.be/BZvHo2pE5t8?t=75

Everything about the Apple product is like that Pepsi commercial.
All promises. No delivery.

They believe it. So when you tell them that they won't get the girl in the
video even if they bought a hundred cases of Pepsi, they're all flustered.

Back to what's the best password-protection unzipper for all the platforms,
I'm gonna say it's probably WinZip but I don't really know (especially as
you unearthed that it might not actually work on iOS).

Problem is that half of those under 30 phone users will be on that platform
so you can't just write them off if you're trying to send them a file link.

If people know of a single password-enabled unzipper for all five
platforms, that would be a useful bit of data for everyone to write down.

On Wed, 5 Jul 2023 16:25:00 -0400, Paul wrote:

> If the WeTransfer is free, how is the bandwidth paid for ?

It's not only bandwidth that has to be paid for but the billboards erected
all over Europe as WeTransfer seems to be the way to go in the EU domains.

I don't know but I suspect it's paid for by either local ads on the web
page, or they have a payfor service upgrade which adds download privileges.

> The site I use to post photos, their bandwidth bill per month, is $30,000 .
> That's why you ask the question, how some of these services are supported.
> Real, significant, sums of money are involved.

I don't know how they make money either - but I'm assuming some people pay
for the privileges that come with the membership - like at a drinking club.
> At one point, my photo site "lost" its domain. An American takedown
> at a guess. I would not make too many "proud declarations" if I were you.
> It could be, there is an unlocked door on the side of the WeTransfer
> site, and some unsavory individuals enter via that door. And I'm not
> talking about the cleaning staff either.

Which is why encryption would seem to be the best bet for uploaders.

But what encryption can everyone use that the TLAs don't already crack?

I don't know of any. Do you?

On 7/6/2023 3:13 AM, Xavier Aguirre wrote:

> Which is why encryption would seem to be the best bet for uploaders.
>
> But what encryption can everyone use that the TLAs don't already crack?
>
> I don't know of any. Do you?

If I knew the answer to that, I would be a very rich guy :-)

This article shows they nibble around the edges, and
all this means, is you have to pick a method which
is bigger than the cracked ones.

https://www.computerworld.com/article/2550008/the-clock-is-ticking-for-encryption.html

Mar 21, 2011

"But RSA messages with keys as long as 768 bits have been broken, says Paul Kocher,
head of security firm Cryptography Research in San Francisco. "I would guess that
in five years, even 1,024 bits will be broken," he says."

That's why today, you'd use RSA4096. But you also have to remember,
that progress on these is non-linear. One year there might be two papers,
then you could have several years of radio silence.

It's when something is severely broken (MD5 collision computation),
that everyone knows it and they stop using it. It takes
less than a minute on a Pentium 4, to modify a message in such a
way, that it has the same MD5 hash as it had originally (before
being modified).

SHA1 is assumed to be "breakable, with enough effort", but
nobody is really sure whether that's been done yet or not.
If SHA256 is ever cracked, $70 billion worth of Bitcoins
go down the toilet :-) The person who discovers that, is
going to keep that quiet for a bit, while they make
some retirement money.

Try an article like this, to see how close they are getting. Not very close.
Putting malware on your computer, is a much better method for
decoding your stuff. A rubber hose is also a good method.

https://en.wikipedia.org/wiki/Advanced_Encryption_Standard

"This is a very small gain, as a 126-bit key (instead of 128-bits) would
still take billions of years to brute force on current and foreseeable hardware.
Also, the authors calculate the best attack using their technique on AES with
a 128-bit key requires storing 2^88 bits of data. That works out to about
38 trillion terabytes of data, which is more than all the data stored on
all the computers on the planet in 2016. As such, there are no practical
implications on AES security. The space complexity has later been improved
to 256 bits,[28] which is 9007 terabytes (while still keeping a time complexity
of 2^126.2)."

"At present, there is no known practical attack that would allow someone without knowledge
of the key to read data encrypted by AES when correctly implemented."

To meet the conditions of the last paragraph, that's why Igor
had to correct his implementation (the key generation steps
presumably).

Paul

Paul <nospam@needed.invalid> wrote:
> On 7/5/2023 11:24 AM, Frank Slootweg wrote:
> > Paul <nospam@needed.invalid> wrote:
> > [...]
> >
> > [About WeTransfer[.com]:]
> >
> >> These transfer schemes can't last too long.
> >
> > WeTransfer exists since 2009, so quite a long time.
> >
> > <https://wetransfer.com/corporate/about> See the 'History' section.
> >
> >> Mozilla had one, related to Firefox, and they had to
> >> shut that down.
> >>
> >> They're just too hard to police, and keep the authorities happy.
> >
> > We're Dutch, we can't be shut down! :-)
> >
> > FWIW: Yes, I use WeTransfer (once in a while). No, *I* am not 'Arlen'.
> >
>
> If the WeTransfer is free, how is the bandwidth paid for ?

WeTransfer has a Free service, but also other (Pro and Premium)
services and they have other products. Just check the Pricing, Features
and Company buttons on their main page (and other pages).

> The site I use to post photos, their bandwidth bill per month, is $30,000 .
> That's why you ask the question, how some of these services are supported.
> Real, significant, sums of money are involved.
>
> At one point, my photo site "lost" its domain. An American takedown
> at a guess. I would not make too many "proud declarations" if I were you.
> It could be, there is an unlocked door on the side of the WeTransfer
> site, and some unsavory individuals enter via that door. And I'm not
> talking about the cleaning staff either.

Please no FUD, etc.. *Read* their 'About us' (Story, Key Stats,
History and Products). *Then*, if you still have concerns, we'll see.

Paul wrote:

> If the WeTransfer is free, how is the bandwidth paid for ?

Like many internet services, they use a "freemium" pricing model.

On 5/7/2023 4:56 am, Lord Vader wrote:
> I used a torrent to obtain a few hundred books on religion.
> I used calibre to convert all those books to PDFs and M$ Word.
> But I also have them converted to a host of other ebook formats.
>
> The files are big.
> None are smaller than 1MB and many are in the 3MB, 4MB & 5MB size.

Cut the big file into a collection of small files using 7-zip!

"Mr. Man-wai Chang" <toylet.toylet@gmail.com> wrote

>> The files are big.
>> None are smaller than 1MB and many are in the 3MB, 4MB & 5MB size.
>
> Cut the big file into a collection of small files using 7-zip!

That will work for everyone except half the people in the USA with Apple.

For the Apple users you have to keep it to a single click decrypt.

Better to shrink the original file somehow to fit the size limitations.

[comp.text.pdf restored

Wally J <walterjones@invalid.nospam> wrote:
> "Mr. Man-wai Chang" <toylet.toylet@gmail.com> wrote
>
> >> The files are big.
> >> None are smaller than 1MB and many are in the 3MB, 4MB & 5MB size.
> >
> > Cut the big file into a collection of small files using 7-zip!
>
> That will work for everyone except half the people in the USA with Apple.
>
> For the Apple users you have to keep it to a single click decrypt.

This article - see step 6, the last step - seems to imply that for
'Apple' (iPhone/iPad, what about Mac?) it *is* a single 'click' to unzip
a zip archive. (I assume that for a 'decrypt' it asks for the password.)

'Downloading a .zip file on your iPhone or iPad browser'
<https://help.wetransfer.com/hc/en-us/articles/210092373-Downloading-a-zip-file-on-your-iPhone-or-iPad-browser>

> Better to shrink the original file somehow to fit the size limitations.

"1MB and many are in the 3MB, 4MB & 5MB size" is peanuts! A WeTransfer
transfer can handle 2*GB*, i.e. at least *400* of these files in a
single transfer.

Charles Jack Jones <charliejackjones@cjj.com> wrote in
news:u85nhp$328m3$1@news.samoylyk.net:

> On Wed, 05 Jul 2023 18:15:00 +0000, DanS wrote:
>

<SNIP>

>> I don't have a problem with expiration...but 10 days
>> sounds a little short.
>
> I guess there are two answers to that, in that I would
> agree ten days is, well, it's only a week and a half -
> which is short but it's probably "long enough" if you are
> sending a link to someone in a web forum to get a file.
>
> Also, the way it's worded, I think it's not ten days but
> ten days after different IP addresses are downloading the
> file from your link.

That is exactly how it works. If no one d/l's it in x amount of time, it's gone. It 'resets' the
timer with each d/l.

On 7/6/23 4:50 AM, Paul wrote:
> On 7/6/2023 3:13 AM, Xavier Aguirre wrote:
>
>> Which is why encryption would seem to be the best bet for uploaders.
>>
>> But what encryption can everyone use that the TLAs don't already crack?
>>
>> I don't know of any. Do you?
>
> If I knew the answer to that, I would be a very rich guy :-)
>
> This article shows they nibble around the edges, and
> all this means, is you have to pick a method which
> is bigger than the cracked ones.
>
> https://www.computerworld.com/article/2550008/the-clock-is-ticking-for-encryption.html
>
>
>     Mar 21, 2011
>
>    "But RSA messages with keys as long as 768 bits have been broken,
> says Paul Kocher,
>     head of security firm Cryptography Research in San Francisco. "I
> would guess that
>     in five years, even 1,024 bits will be broken," he says."
>
> That's why today, you'd use RSA4096. But you also have to remember,
> that progress on these is non-linear. One year there might be two papers,
> then you could have several years of radio silence.
>
> It's when something is severely broken (MD5 collision computation),
> that everyone knows it and they stop using it. It takes
> less than a minute on a Pentium 4, to modify a message in such a
> way, that it has the same MD5 hash as it had originally (before
> being modified).
>
> SHA1 is assumed to be "breakable, with enough effort", but
> nobody is really sure whether that's been done yet or not.
> If SHA256 is ever cracked, $70 billion worth of Bitcoins
> go down the toilet :-) The person who discovers that, is
> going to keep that quiet for a bit, while they make
> some retirement money.
>
> Try an article like this, to see how close they are getting. Not very
> close.
> Putting malware on your computer, is a much better method for
> decoding your stuff. A rubber hose is also a good method.
>
> https://en.wikipedia.org/wiki/Advanced_Encryption_Standard
>
>    "This is a very small gain, as a 126-bit key (instead of 128-bits)
> would
>     still take billions of years to brute force on current and
> foreseeable hardware.
>     Also, the authors calculate the best attack using their technique
> on AES with
>     a 128-bit key requires storing 2^88 bits of data. That works out
> to about
>     38 trillion terabytes of data, which is more than all the data
> stored on
>     all the computers on the planet in 2016. As such, there are no
> practical
>     implications on AES security. The space complexity has later been
> improved
>     to 256 bits,[28] which is 9007 terabytes (while still keeping a
> time complexity
>     of 2^126.2)."
>
>    "At present, there is no known practical attack that would allow
> someone without knowledge
>     of the key to read data encrypted by AES when correctly implemented."
>
> To meet the conditions of the last paragraph, that's why Igor
> had to correct his implementation (the key generation steps
> presumably).
>
>    Paul
Would a binary news group work with good encryption?

On 7/7/2023 2:50 PM, Nic wrote:

> Would a binary news group work with good encryption?

If you're talking about transmissions between a USENET server
and your computer, Port 119 is unencrypted. Any "observer"
along the path, can see your user:pass, as well as the (text)
messages that you are reassembling to make some binary thing.

When you use port 563, that's encrypted. First, an SSL/TLS
session is lashed up between you and the server, then, if
the server needs user:pass , that is exchanged as usual.

You are relying in that case, on SSL/TLS. Only the latest
TLS is secure, and it depends on using one of the good
crypto standards.

If the server lifts the standard too high, then no clients
would be able to connect on port 563.

You see this very occasionally, on some web servers, where
the web server is set to TLS 1.3 and only a couple crypto
methods are accepted. And then, almost no browser in your
"fleet" will work with it.

I don't know any more details about it, than that. Like,
right now, what standard is my USENET client using ? I don't
know. It is probably TLS, but I don't know which one.

Paul

On Fri, 7 Jul 2023 14:50:09 -0400, Nic <Nic@none.net> wrote:

>Would a binary news group work with good encryption?

When it comes to binary files, Usenet is a one-to-many type of service,
as you probably know. Upload once, download any number of times by any
number of clients, anywhere in the world where there is Usenet access.

What would make me uncomfortable is the fact that Usenet binary file
uploads never expire. Some of the mid-level NSPs might expire files *on
their server*, but the bigger players stopped expiring binary uploads in
the early 2000s, give or take a few years. Files that were uploaded
15-20 years ago are typically still available today.

It used to be that some groups, such as alt.binaries.test and a few
others like it, would have an intentionally short retention time, but
that doesn't appear to be the case anymore. (My NSP currently has files
in a.b.test dating back to 14.8 years, and going forward nothing is
being deleted.)

Encryption of the file itself, as well as encryption of the connection
needed to upload/download the file, have been addressed by others.