2 ms·
There's also another leak which isn't really shown here and that leak is that, with just a public key, you can offer to servers and they'll tell you if it's pre
by ultramancool 11y ago
There's also another leak which isn't really shown here and that leak is that, with just a public key, you can offer to servers and they'll tell you if it's present or not.
Using this you could scan the internet (given 6-12 hours and a shitty VPS that you can throw away this is quite possible) for someone's public key to find all of their servers, which could lead to a bypass of DDoS protection, identification of a Tor hidden service, etc.
- versteegen 11y agoYep, see also Rachelbythebay's comment in this thread (in particular the second post she links to); this is definitely exploitable. https://news.ycombinator.com/item?id=10008012 https://news.ycombinator.com/item?id=10008012