3 ms·
If you look at past attacks that had a name and logo it's often not that these attacks were particularly dangerous. Think about Spectre. What these attacks oft
by hannob 5y ago
If you look at past attacks that had a name and logo it's often not that these attacks were particularly dangerous. Think about Spectre.
What these attacks often do however is breaking existing expectations. I think this attack ticks quite a few boxes there. It questions the idea that TLS can be "layered" on top of existing protocols and just be secure without consideration for the underlying protocols. It breaks security independently of all the fancy crypto we have in TLS 1.3 that we enforced due to previous attacks on weak crypto. It shows a generic problem with TLS that hasn't been tackled properly yet.
- tptacek 5y agoIt's interesting because there's at least two audiences for vulnerability research. The preceding comment is the obvious audience: people wondering if they need to patch. But for some vulnerabilities, the more important audience is computer science. Alpaca might be almost irrelevant to people who operate systems, but it's profoundly relevant to people studying secure transports and their vulnerabilities. It very much deserves whatever name the team chose to gave it.