5 ms·

Looks like you didn't understand the sadness of the issue I was reporting. The author of the software constructed his own random number generator from two primi

by dchest 11y ago

Looks like you didn't understand the sadness of the issue I was reporting. The author of the software constructed his own random number generator from two primitives: Salsa20 stream generator and Math.random. The last part is what makes this PRNG theoretically insecure: because Math.random is not guaranteed to give cryptographically secure random numbers, thus, theoretically, the generated passwords can be guessed. (The fact that there are no current attacks on current implementations of Math.random in browsers doesn't mean that we won't get them in the future.) The secure alternative to author's PRNG is ~one line of code: window.crypto.getRandomBytes. There are no tradeoffs involved! On the contrary, the author's insecure construction is more difficult to write than the secure one. (BTW, while we here argue about security experts, the author said "Thank you, I'll replace it of course.")

Touche 11y ago
This is what I'm talking about. You, a security enthusiast, are only interested in the technical security details. You respond to a comment about tradeoffs with details on the bug. I don't care about why the bug happened or how easy it is/isn't to fix. I care about whether the existence of the bug is something I should be so concerned about as to not use the software. In order to gauge that, I need a little more info about the threat level.
- Nadya 11y ago
  >I don't care about why the bug happened or how easy it is/isn't to fix. I care about whether the existence of the bug is something I should be so concerned about as to not use the software. In order to gauge that, I need a little more info about the threat level. Threat level is 0%. No currently known attacks exist. This threat level immediately goes to 100% when a practical attack is discovered. There is no guarantee that a practical attack exists that hasn't been brought to academic or mainstream attention (e.g some cracker has a practical attack that they're keeping under wraps). By the time the threat level hits 100% the cracker may have already broken into your account(s) before you even hear about the attack. Therefore when something is shown that "attacking it is possible" you can make one of two assumptions 1) No practical attack exists and you'll be safe until it exists 2) A practical attack already exists and it is only a matter of time until you get pwned Rather than worry about whether or not a practical attack already or will one day exist, I'd use cryptography that hasn't been shown to be broken.
  - Touche 11y ago
    This comment doesn't make sense. All attacks are not equal. Some require physical access; some do not. Some require seed data; some do not. What exactly are you talking about here? This is why security people are so frustrating to talk to; you only talk in extremes. > Rather than worry about whether or not a practical attack already or will one day exist, I'd use cryptography that hasn't been shown to be broken. That's not what I'm worried about. I'm worried about given that they do exist what is the risk to me? What is the likelihood that my account has been broken into?
    - dchest 11y ago
      I'm worried about given that they do exist what is the risk to me? What is the likelihood that my account has been broken into? ¯\_(ツ)_/¯
    - Nadya 11y ago
      >This comment doesn't make sense. All attacks are not equal. Some require physical access; some do not. Some require seed data; some do not. What exactly are you talking about here? I'm not a security expert, more of a hobbyist. So I'll let someone else quantify potential specifics. To my understanding, they would not require physical access and would be able to guess any passwords generated (once an attack has been found/created). >That's not what I'm worried about. I'm worried about given that they do exist what is the risk to me? What is the likelihood that my account has been broken into? The chances of 0 becoming 1 are not quantifiable because it requires knowing unknowns. It is, however, non-zero. For a small list of unknowns: 1) Who knows about the attack 2) How practical is the attack? 3) What software/websites/people are they choosing to attack 4) Are you even using any of the software/websites that are being attacked? 5) Are they going to accept cracking <10%~ accounts if they can do so in <24 hours or is their goal to crack >50%~ accounts? Many crackers only care to scrape the bottom of a barrel. What are the chances you were in the part of the barrel they scraped? I assume the worst because being compromised is a zero-sum game. I've been compromised or I haven't. Therefore my variables are: Everyone. Extremely. Only things I use. Of course. Doesn't matter, I'm in the targeted group. I wouldn't make any bets on security through obscurity.

by dchest 11y ago

Touche 11y ago

This is what I'm talking about. You, a security enthusiast, are only interested in the technical security details. You respond to a comment about tradeoffs with details on the bug. I don't care about why the bug happened or how easy it is/isn't to fix. I care about whether the existence of the bug is something I should be so concerned about as to not use the software. In order to gauge that, I need a little more info about the threat level.

Nadya 11y ago
>I don't care about why the bug happened or how easy it is/isn't to fix. I care about whether the existence of the bug is something I should be so concerned about as to not use the software. In order to gauge that, I need a little more info about the threat level. Threat level is 0%. No currently known attacks exist. This threat level immediately goes to 100% when a practical attack is discovered. There is no guarantee that a practical attack exists that hasn't been brought to academic or mainstream attention (e.g some cracker has a practical attack that they're keeping under wraps). By the time the threat level hits 100% the cracker may have already broken into your account(s) before you even hear about the attack. Therefore when something is shown that "attacking it is possible" you can make one of two assumptions 1) No practical attack exists and you'll be safe until it exists 2) A practical attack already exists and it is only a matter of time until you get pwned Rather than worry about whether or not a practical attack already or will one day exist, I'd use cryptography that hasn't been shown to be broken.
- Touche 11y ago
  This comment doesn't make sense. All attacks are not equal. Some require physical access; some do not. Some require seed data; some do not. What exactly are you talking about here? This is why security people are so frustrating to talk to; you only talk in extremes. > Rather than worry about whether or not a practical attack already or will one day exist, I'd use cryptography that hasn't been shown to be broken. That's not what I'm worried about. I'm worried about given that they do exist what is the risk to me? What is the likelihood that my account has been broken into?
  - dchest 11y ago
    I'm worried about given that they do exist what is the risk to me? What is the likelihood that my account has been broken into? ¯\_(ツ)_/¯
  - Nadya 11y ago
    >This comment doesn't make sense. All attacks are not equal. Some require physical access; some do not. Some require seed data; some do not. What exactly are you talking about here? I'm not a security expert, more of a hobbyist. So I'll let someone else quantify potential specifics. To my understanding, they would not require physical access and would be able to guess any passwords generated (once an attack has been found/created). >That's not what I'm worried about. I'm worried about given that they do exist what is the risk to me? What is the likelihood that my account has been broken into? The chances of 0 becoming 1 are not quantifiable because it requires knowing unknowns. It is, however, non-zero. For a small list of unknowns: 1) Who knows about the attack 2) How practical is the attack? 3) What software/websites/people are they choosing to attack 4) Are you even using any of the software/websites that are being attacked? 5) Are they going to accept cracking <10%~ accounts if they can do so in <24 hours or is their goal to crack >50%~ accounts? Many crackers only care to scrape the bottom of a barrel. What are the chances you were in the part of the barrel they scraped? I assume the worst because being compromised is a zero-sum game. I've been compromised or I haven't. Therefore my variables are: Everyone. Extremely. Only things I use. Of course. Doesn't matter, I'm in the targeted group. I wouldn't make any bets on security through obscurity.