3 ms·
I think he was only (or mostly) talking about the latter, which I would agree isn't very complicated at all (it's just deleting and regenerating keys/certs on a
by buu700 10y ago
I think he was only (or mostly) talking about the latter, which I would agree isn't very complicated at all (it's just deleting and regenerating keys/certs on an interval).
As to the former, are you referring to specific known side channel attacks against asm.js/wasm, or just the usual XSS risk?
- tptacek 10y agoOne would hope that the founder of the company trying to bring that weird secure caching attempt to market would believe that it wasn't very complicated. :) Of course, if you've filed for patents on this, as was suggested upthread, that somewhat cuts against that argument, doesn't it?
- buu700 10y agolol, I'm definitely biased given that I'm long since familiar with the idea and wrote the implementation, but I think it's more conceptually counterintuitive/clever/weird than it is actually complicated in terms of having many moving parts. WebSign does have a patent pending on it (I think it's fair enough to say that the whole system of accomplishing in-browser code signing this way was non-obvious), but HPKP Suicide itself doesn't. Bryant (eganist) and I are actually disclosing and open sourcing implementations of a few non-code-signing applications of HPKP Suicide at Black Hat and DEF CON next month.
- cyphar 10y ago> WebSign does have a patent pending on it (I think it's fair enough to say that the whole system of accomplishing in-browser code signing this way was non-obvious), Yay, another technology to boycott entirely.