2 ms·
OK, it's clearly junk crypto, but do you know enough to explain exactly what went wrong? I heard something about being able to generate private keys from the s
by javert 15y ago
OK, it's clearly junk crypto, but do you know enough to explain exactly what went wrong?
I heard something about being able to generate private keys from the serial numbers of the tokens, but even if that's the case, you'd need to know what token/serial number you acutally care about. Not all users are going to have access to anything interesting.
- jwegan 15y agoFTA lawnchair_larry linked to: He said the initial RSA attack was followed by malware and phishing campaigns seeking specific data that would link tokens to end-users, which meant the current attacks may have been carried out by the same hackers.
- Getahobby 15y agoYou also need to get the PIN that the specific user is using in addition to the access code from the token. You can use it without a PIN but that is reducing it to a single factor auth solution.