Skip to content
Snippets Groups Projects
  1. Dec 10, 2015
  2. Dec 08, 2015
  3. Dec 04, 2015
  4. Dec 03, 2015
  5. Dec 02, 2015
  6. Nov 30, 2015
  7. May 02, 2015
  8. May 01, 2015
  9. Apr 29, 2015
  10. Apr 03, 2015
  11. Jan 14, 2015
  12. Jan 09, 2015
  13. Jan 06, 2015
  14. Jan 05, 2015
  15. Dec 29, 2014
    • akwizgran's avatar
      Don't try to erase secrets from memory. · 358166bc
      akwizgran authored
      1. The things we're really trying to protect - contact identities,
      message contents, etc - can't be erased from memory because they're
      encapsulated inside objects we don't control.
      
      2. Long-term secrets can't be protected by erasing them from memory
      because they're stored in the database and the database key has to be
      held in memory whenever the app's running.
      
      3. If the runtime uses a compacting garbage collector then we have no
      way to ensure an object is erased from memory.
      
      4. Trying to erase secrets from memory makes the code more complex.
      
      Conclusion: Let's not try to protect secrets from an attacker who can
      read arbitrary memory locations.
      358166bc
    • akwizgran's avatar
      Moved stream crypto to crypto component. · f316d64a
      akwizgran authored
      f316d64a
  16. Dec 14, 2014
  17. Dec 13, 2014
    • akwizgran's avatar
      Application layer keepalives to detect dead TCP connections. · d4fa656d
      akwizgran authored
      DuplexOutgoingSession flushes its output stream if it's idle for a
      transport-defined interval, causing an empty frame to be sent. The TCP
      and Tor plugins use a socket timeout equal to twice the idle interval to
      detect dead connections.
      
      See bugs #27, #46 and #60.
      d4fa656d
  18. Nov 25, 2014
  19. Nov 08, 2014
  20. Nov 06, 2014
  21. Nov 05, 2014
Loading