3 ms·
That sounds maybe plausible, although what could they have possibly been debugging that required a weaker hash? Of course, with the paranoid hat on, if your ta
by 0x0 10y ago
That sounds maybe plausible, although what could they have possibly been debugging that required a weaker hash?
Of course, with the paranoid hat on, if your task was to subvert the mechanism, this is probably exactly how you'd go about it - make it seem like an accident. Just like gotofail :)
- camillomiller 10y agoYeah, and hide it in plain sight. Plausible, yes. Although goto fail; had another vibe to it. It was really strangely placed and hardly explainable. Plus it made possible to perform some pretty nasty MiTM attacks over a network. Here you have a method that security experts tinkering with the betas knew of since probably last July. Everybody expected Apple to fix it in the GM, but it didn't happen. Now the cat's out of the bag with some deservedly good (and harmless) publicity for Elcomsoft and it's gonna be fixed in no time. If we even want to give credit to the malicious actor hypothesis, what's the benefit for them? Accessing iOS 10 beta backups more easily for three months? Nah, I don't see that, not this time.
- jobu 10y ago> Although goto fail; had another vibe to it. It was really strangely placed and hardly explainable. Plus it made possible to perform some pretty nasty MiTM attacks over a network. The goto fail looked very much like a bad code merge. (I actually had a similar issue with a duplicated line when merging changes two days ago.) It's impossible to know without reviewing their full source control history, but it seemed like a plausible mistake to me.
- camillomiller 10y agoOk, good explanation. Let's slit that one with the Occam razor too, then :)