4 ms·
Maybe I misunderstand, but wouldn't the attack be visible to the user when the encryption glitches out and they have to reattempt the login or something?
by im3w1l 4y ago
Maybe I misunderstand, but wouldn't the attack be visible to the user when the encryption glitches out and they have to reattempt the login or something?
- tptacek 4y agoNo! That's another amazing detail here. The attacker is the server, and so it can just pretend you logged in successfully. You won't have fetched your key properly, but the Mega client automatically re-fetches the key when that happens.
- im3w1l 4y ago> You won't have fetched your key properly, but the Mega client automatically re-fetches the key when that happens. Is that something it could hypothetically do, or something that the current code does? In the latter case, is there any legitimate reason for doing that? And this would be detectable right, maybe not by a casual observer, but by a security researcher?
- tptacek 4y agoHow would you know? The whole point of the cryptosystem is you can't assume what the server code is doing.
- im3w1l 4y agoWell you said the client refetches the key, so that sounds like a network request you could observe.
- tptacek 4y agoSure; you could also look for all-zero SIDs. That relies on you knowing about this attack a priori, and if you know about it you can just not have the vulnerability.
- im3w1l 4y agoYeah, I was just trying to evaluate the risk that >Mega could have run this attack over long periods of time, in parallel for all its users; without anybody catching on. In light of our discussion, I don't think it's too likely.
- tptacek 4y agoNo, I don't agree at all. There is literally new science in this paper; the idea that random "security researchers" looking at benign-looking crypto code and monitoring all the connections their clients made (a thing nobody does) would ever have caught this is not plausible.
- im3w1l 4y agoActually I have a second question about this point.. Does this mean it would allow the user in even if the password is mistyped?
- tptacek 4y agoNo, if you mistype the password then the server can't look up your escrowed RSA key (it's looked up with an "authentication key" derived from PBKDF2).