4 ms·

I agree their disclosure strategy pretty effed up. Nevertheless, if BEAST is basically an exploit on the Bard attack that's been known for years, perhaps it su

I agree their disclosure strategy pretty effed up. Nevertheless, if BEAST is basically an exploit on the Bard attack that's been known for years, perhaps it suggests that there was an insufficiency of hype around the original publication.

skeptical 15y ago
I would go further and say anyone can claim they "broke" whatever system. Why do we even care about this. PoC or it didn't happen. Also, 'SSL broken' it's a way abusive title to whatever hack relying on non encrypted http requests, javascript injection and so on. But the real question: why do people pay so much attention to this here at HN? Why does it gets discussed as if would be given for a fact when all we have are rumors? I think people just like to talk vaguely about crypto, throwing a few concepts and hypothesis around migt be enough for many to feel intelligent...?
- marshray 15y ago
  Duong and Rizzo have a proven track record. The demo is scheduled for Friday http://www.ekoparty.org/2011/juliano-rizzo.php http://www.ekoparty.org/2011/juliano-rizzo.php
moxie 15y ago
Maybe, we don't know. I'm guessing that @agl can't respond in detail, because he's likely bound by whatever disclosure agreement the Chrome team entered into, but he's a smart cookie and I'm inclined to trust his assessment. I obviously have no way to know whether this is a big deal or not. These guys have a "proven track record" from the ASP.net thing, but remember that attack came after a number of less-than-earth-shattering releases from them around padding oracles in other circumstances.
- marshray 15y ago
  Yeah. But something that might look like an insignificant corner case to a browser vendor might mean that your own SSL/TLS app is 100% pwned. These guys need to publish the details now. Let the baby be born and not try to prolong the delivery for their own personal reasons.
- aortega 15y ago
  > but remember that attack came after a number of less-than-earth-shattering releases from them around padding oracles in other circumstances. So, that attack is less valid because it was gradually developed. That phrase doesn't make any sense.

skeptical 15y ago

I would go further and say anyone can claim they "broke" whatever system. Why do we even care about this. PoC or it didn't happen. Also, 'SSL broken' it's a way abusive title to whatever hack relying on non encrypted http requests, javascript injection and so on. But the real question: why do people pay so much attention to this here at HN? Why does it gets discussed as if would be given for a fact when all we have are rumors? I think people just like to talk vaguely about crypto, throwing a few concepts and hypothesis around migt be enough for many to feel intelligent...?

marshray 15y ago
Duong and Rizzo have a proven track record. The demo is scheduled for Friday http://www.ekoparty.org/2011/juliano-rizzo.php http://www.ekoparty.org/2011/juliano-rizzo.php

moxie 15y ago

Maybe, we don't know. I'm guessing that @agl can't respond in detail, because he's likely bound by whatever disclosure agreement the Chrome team entered into, but he's a smart cookie and I'm inclined to trust his assessment. I obviously have no way to know whether this is a big deal or not. These guys have a "proven track record" from the ASP.net thing, but remember that attack came after a number of less-than-earth-shattering releases from them around padding oracles in other circumstances.

marshray 15y ago
Yeah. But something that might look like an insignificant corner case to a browser vendor might mean that your own SSL/TLS app is 100% pwned. These guys need to publish the details now. Let the baby be born and not try to prolong the delivery for their own personal reasons.
aortega 15y ago
> but remember that attack came after a number of less-than-earth-shattering releases from them around padding oracles in other circumstances. So, that attack is less valid because it was gradually developed. That phrase doesn't make any sense.