3 ms·
> Impact of Workaround: If an error occurs during a web transaction, > the web clients will see the same generic error message on the > server, regardless o
by alecco 16y ago
> Impact of Workaround: If an error occurs during a web transaction,
> the web clients will see the same generic error message on the
> server, regardless of what error actually occurs.
It looks like Microsoft didn't get it. Juliano/Thai showed timing the error was as useful as checking the error type.
- ronnier 16y agoThis isn't a patch, only a workaround until a patch is released. The workaround includes random bits of time and generic error pages, I'm sure the official patch will be more than that.
- alecco 16y agoThe workaround doesn't work around the vulnerability. It only works around the most obvious implementation. This gives a false sense of security.
- tptacek 16y agoAgree strongly with this, for what it's worth. It also perpetuates an obnoxious myth about hiding side channels (see above thread).