5 ms·
I disagree that it would take man-years to fish that out from a binary. Black hat and white hat hackers do this all the time.
by buzzert 7y ago
I disagree that it would take man-years to fish that out from a binary. Black hat and white hat hackers do this all the time.
- londons_explore 7y agoI agree. The crypto used is industry standard, and the actual process all the way from random number generation to deriving a key is relatively easy to follow. Active ways to attack the client to make it leak the key are far more worrying - but even an open source project wouldn't protect against that.
- huhtenberg 7y agoAgain, it may very well be a vanilla TLS, but then you have a bit of code in some obscure corner that repoints random() to an alternative weaker implementation when some conditions are met, including, for example, not being run under a debugger and not having certain popular functions trampolined. Good luck finding even this without a fine comb. And that's us just getting started with code flow obfuscation. No source = no trust. It's as simple as that.