3 ms·
That's incredible. I know Emotiv invested considerable time and money into "securing" the feed coming off the headset -- and it's broken in less than 24h by an
by frisco 16y ago
That's incredible. I know Emotiv invested considerable time and money into "securing" the feed coming off the headset -- and it's broken in less than 24h by an individual (our own daeken!). That send a pretty powerful message about proprietary hardware...
- sp332 16y ago"But... but we used 128-bit AES! It's rated for U.S.A. Classified Secret information!" Yeah, but you put the S-box (AES key initialization) in the code you sent to the end-user. Also, ECB http://en.wikipedia.org/wiki/Block_cipher_modes_of_operation#Electronic_codebook_.28ECB.29 http://en.wikipedia.org/wiki/Block_cipher_modes_of_operation... So... yeah.
- daeken 16y agoI hate to say this, but ECB is actually the right way to go here. There's no way to send information to the headset, so CBC with a rolling IV wouldn't work well -- if one HID report dropped, you'd have no way of regaining the stream again. Of course, they could've XORed the second half of the output report with the first (CBC across the output report itself), but that really gets you nothing. This is, amazingly, one of the few places where ECB actually makes sense. That said, when will people learn to encrypt/pack/invert/anything their S-boxes? Edit: Scratch what I said defending ECB mode. I totally forgot about CTR mode until a friend just mentioned it. Would've been the perfect solution here.
- deleted 16y ago[deleted]
- TheAmazingIdiot 16y agoYou know, so many in the tech community always called Stallman a lunatic and crazy for his outlandish views. Yet, he's been spot on nearly every time a company does stunts like this. Tivo spent how much money and time to prevent us from owning our computer-hence the GPL3. We see Linksys stole code until they finally released a pack months later, package signed too. And this company spent gobs in crypto chips and obfuscation and time to secure what took 24 hrs to properly fix (and yes, I do mean fix). Even nasty tripwire and DRM laden PS3 has been rooted, as have 'unbeatable' blu-ray. C'mon people: when are companies going to realize that this kind of behavior eventually hurts them? For you engineer types: why do you do (and redo) this?
- oomkiller 16y agoI doubt the engineers are responsible for perpetrating most DRM schemes. I'd blame it on the suits before them.
- bigmac 16y agoI'd be interested in the "considerable time and money" you are talking about. Reading daeken's analysis makes it look like they did not try at all.