HN user

dimiprasakis

7 karma

I am a cybersecurity researcher and the founder of Minoan Security (minoansecurity.com), a Swiss cybersecurity research and professional services firm focused on systems security (+AI security and observability).

I am currently an M.Sc. Cybersecurity candidate at Georgia Tech and a certified CISSP.

My professional and academic interests span systems/infra security, AI security, and privacy.

I have held security engineering roles across finance, healthcare, and tech, including at the Swiss Infrastructure & eXchange (SIX Group AG) and Trade Republic.

Posts2
Comments6
View on HN

Cool approach.

But, a compromise still lands on host's kernel, Docker doesn't provide kernel isolation (well it does on a macOS because it runs in Docker machine but thats a side effect).

I wonder if a better solution would be to play with seccomp or Linux capabilities so that Chrome is sandboxed even in Docker. Not sure how this would work tbh.

Answering here to get ideas, I saw your fix on Git and request for feedback (will try to review and give it some thought once I find some time)

Linux 7.1 1 month ago

- "Anyway, possible slight hiccups in the merge window aside, the news today is 7.1." - "nothing particularly interesting or scary stands out, which is as it should be."

So, a number.

To be honest, I always wondered why variations of SSS haven't been seen commercial adoption more. For example, instead of storing API Keys in GitHub repos, the keys could be constructed on the fly by approvers signing their shares. I guess the UX of coordinating share-holders is what kills most implementations...

SSS does suffer though for some serious weaknesses, i.e. it trusts the shareholders. A cheating party can submit a fake share during reconstruction, corrupting the recovered secret, and honest parties have no way to detect this something that verifiable secret sharing fixes.

Anyway threshold crypto is a very elegant field and the math is there is really beautiful.