3 ms·
To add onto this, the reason ECB mode is so horribly bad, is that it produces the same cyphertext for blocks with the same plaintext. This allows an attacker t
by Leo_Verto 4y ago
To add onto this, the reason ECB mode is so horribly bad, is that it produces the same cyphertext for blocks with the same plaintext.
This allows an attacker to detect repeating plain text segments, e.g. reused passwords.
The Wikipedia article on block cypher modes illustrates this problem rather well [1].
[1]: https://en.wikipedia.org/wiki/Block_cipher_mode_of_operation#Electronic_codebook_(ECB) https://en.wikipedia.org/wiki/Block_cipher_mode_of_operation...
- zinekeller 4y agoECB Penguin! (https://words.filippo.io/the-ecb-penguin/ https://words.filippo.io/the-ecb-penguin/) Also, I've just learned that the quintessential file has been recently replaced. I understand the need for a higher resolution file, but I'm still a bit sad.
- evandale 4y agoHah, that first tweet is classic https://xkcd.com/1053/ https://xkcd.com/1053/ and I'm one of the 10000 today :) Today is the first time I've seen the penguin!
- bbbbb5 4y ago>This allows an attacker to detect repeating plain text segments, e.g. reused passwords. This is hardly a problem, any login form will also allow an attacker to do this.
- ilyt 4y ago... actually that might be a "feature" for them, they do have duplicate password report, I had assumed that's just based off decrypted ones on client side but they might be just using ECB for that
- insanitybit 4y agoThat report requires you enter your master password, so I doubt it.