3 ms·
Pretending to use encryption when you don't is pretty damning. Everything else can be blamed on incompetence but it seems hard to imagine that they thought they
by simias 9y ago
Pretending to use encryption when you don't is pretty damning. Everything else can be blamed on incompetence but it seems hard to imagine that they thought they were using AES256 when they aren't.
- qwerty456127 9y agoI have always believed ALL the BlueTooth connections are encrypted strongly too. And this is why I thought BlueTooth keyboards are safe while common non-BT wireless keyboards can be easily sniffed by a neighbour.
- YouKnowBetter 9y agoBluetooth <> Bluetooth. There are (about) 37 distinct profiles [0]. One of these is HID (Human Interface Device Profile) Keyboard and keypads must be secure. For other HIDs security is optional. [0] https://en.wikipedia.org/wiki/List_of_Bluetooth_profiles https://en.wikipedia.org/wiki/List_of_Bluetooth_profiles
- FooHentai 9y agoNah, it differs between the Bluetooth device profiles, and even wildly within each profile. Audio headsets are particularly weak - Ostensibly using a '128 bit' cypher in many instances which turns out to be the c0 stream cypher, proven to be weak and effectively only 56 bit. The situation is exacerbated by how little product manufacturers have to say on the subject.
- IshKebab 9y agoActually having worked a lot with BLE it isn't hard to imagine at all. The way to set up encryption is really very weird, and there isn't any obvious indication that it is enabled.
- weq 9y agoIf u are a non-technical founder and outsource your dev work, and no one audits anything, its very easy to claim stuff that doesnt actually exist. Willful(?) ignorance. At my last employeer we handled legal data over the internet and all the encryption had been disabled and never turned back on. The CTO was a DBA, and the CEO thought he was god and never questioned anything he produced. I came in and almost left straight away, but felt sorry for the clients who paid for this garbage. And the (multiple different) legal software platforms we integrated with was not much better, embedding master passwords / decryption routines in un-obfuscated dlls.
- jnbiche 9y agoSo what happened? Did you manage to convince the CEO that the work was shoddy?
- rjbwork 9y agoSeems like the FTC could go after them for false advertising. I'd go as far as saying that this product is a scam. It seems like it doesn't actually do any of what it claims to do. It's like putting your guns in a normal safe, setting it to 0-0-0-0-0 and writing the code on the outside.