4 ms·

Deleted his tweet but Alex Stamos offered help for a 10% cut https://web.archive.org/web/20210112200826/https://twitter.com/alexstamos/status/13489991787020574

by bdz 6y ago

Deleted his tweet but Alex Stamos offered help for a 10% cut https://web.archive.org/web/20210112200826/https://twitter.com/alexstamos/status/1348999178702057476 https://web.archive.org/web/20210112200826/https://twitter.c... https://web.archive.org/web/20210112142941/https://twitter.com/alexstamos/status/1348999856111591424 https://web.archive.org/web/20210112142941/https://twitter.c... >Um, for $220M in locked-up Bitcoin, you don't make 10 password guesses but take it to professionals to buy 20 IronKeys and spend six months finding a side-channel or uncapping. I'll make it happen for 10%. Call me. >We're not talking about some NSA-built crypto processor installed on an SSBN, but an old $50 piece of consumer kit. There is no way it's hardened against the last ten years of USENIX papers that have never been used in practice. Co-founder and former IronKey CEO also chimed in https://twitter.com/davejevans/status/1349075762322702336 https://twitter.com/davejevans/status/1349075762322702336 https://twitter.com/davejevans/status/1349083685165834240 https://twitter.com/davejevans/status/1349083685165834240 >I was co-founder and CEO of IronKey. We had numerous conversations with the NSA during the development of the products. If the person is using the first generation of IronKey before we sold the company to Imation, it will be very challenging. >A good first step is to try to image the NAND flash. Then it will not be destroyed. You can certainly try to brute force the AES encrypted contents. It's CBC mode AES by the way. Keys generated by FIPS compliant RNG. See you in 1,000 years.

huac 6y ago
Area men talk book
bitwize 6y ago
Yes, and for that kind of money Ehrlich Bachman would take 5% to let you crash at his place while you figured out how to crack the password.
pjkundert 6y ago
I know David. If he's saying it, then it's very likely true. Smartest guy I know...
- meowster 6y ago
  "very challenging" ≠ impossible It would be very challenging for ne to build an app, for many people on HN, it would be trivial.
randompwd 6y ago
How annoying that Alex Stamos deleted both tweets when it became apparent to others he was talking nonsense. > >We're not talking about some NSA-built crypto processor installed on an SSBN, but an old $50 piece of consumer kit. There is no way it's hardened against the last ten years of USENIX papers that have never been used in practice I don't have much hope for his twitter byline: > Trustworthy tech at the Stanford Internet Observatory Obviously not trustworthy if he's deleting tweets which show him in a negative light - i.e. talking authoritatively out of his arse on subjects which more informed people call him out on. And then deleting any evidence of it.
- ryanmercer 6y ago
  >Obviously not trustworthy if he's deleting tweets which show him in a negative light Or, you know, maybe gobs of people crawled out of the woodwork harassing him and/or begging him to get into their wallets that they can't access. Both of which are extremely plausible and valid reasons for deleting the tweet. Even the individual with the wallet going "sure, let's talk offline" is a valid reason to remove tweets.
  - randompwd 6y ago
    Maybe re-read my comment. He deleted multiple tweets including the one I quoted: > We're not talking about some NSA-built crypto processor installed on an SSBN, but an old $50 piece of consumer kit. There is no way it's hardened against the last ten years of USENIX papers that have never been used in practice
bawolff 6y ago
CEO of crypto company claiming their product is secure isn't super meaningful. It might be true, but they would probably say that regardless. That said, side channels may not be that relavant if you're starting from a place of having to guess the key. Usually that's more about leaking secrets, not bypassing the encryption from a cold start state.

by bdz 6y ago

huac 6y ago

Area men talk book

bitwize 6y ago

Yes, and for that kind of money Ehrlich Bachman would take 5% to let you crash at his place while you figured out how to crack the password.

pjkundert 6y ago

I know David. If he's saying it, then it's very likely true. Smartest guy I know...

meowster 6y ago
"very challenging" ≠ impossible It would be very challenging for ne to build an app, for many people on HN, it would be trivial.

randompwd 6y ago

How annoying that Alex Stamos deleted both tweets when it became apparent to others he was talking nonsense. > >We're not talking about some NSA-built crypto processor installed on an SSBN, but an old $50 piece of consumer kit. There is no way it's hardened against the last ten years of USENIX papers that have never been used in practice I don't have much hope for his twitter byline: > Trustworthy tech at the Stanford Internet Observatory Obviously not trustworthy if he's deleting tweets which show him in a negative light - i.e. talking authoritatively out of his arse on subjects which more informed people call him out on. And then deleting any evidence of it.

ryanmercer 6y ago
>Obviously not trustworthy if he's deleting tweets which show him in a negative light Or, you know, maybe gobs of people crawled out of the woodwork harassing him and/or begging him to get into their wallets that they can't access. Both of which are extremely plausible and valid reasons for deleting the tweet. Even the individual with the wallet going "sure, let's talk offline" is a valid reason to remove tweets.
- randompwd 6y ago
  Maybe re-read my comment. He deleted multiple tweets including the one I quoted: > We're not talking about some NSA-built crypto processor installed on an SSBN, but an old $50 piece of consumer kit. There is no way it's hardened against the last ten years of USENIX papers that have never been used in practice

bawolff 6y ago

CEO of crypto company claiming their product is secure isn't super meaningful. It might be true, but they would probably say that regardless. That said, side channels may not be that relavant if you're starting from a place of having to guess the key. Usually that's more about leaking secrets, not bypassing the encryption from a cold start state.