4 ms·
Multiple security flaws found in DeepSeek iOS app, incl sending unencrypted data
- anotherhue 2y agoIn Anno 2025 how does 3DES get past a reviewer?
- hiatus 2y agoBy design.
- ziddoap 2y agoObviously DeepSeek chose it by design, but the question is how it got past the app store reviewers.
- hiatus 2y agoWhy would app store reviewers care about your encryption choices?
- taormina 2y agoThey ask. Encryption has a whole bunch of weird laws around it.
- hiatus 2y agoI am aware of export controls on encryption, but I didn't realize platforms enforce this. TIL, thank you.
- ziddoap 2y agoSpecifically choosing an encryption algorithm that has been known to be insecure for a decade should be indicative of either extreme carelessness or deceptive and malicious intent. Considering that use of the app store is forced, purportedly to keep users of iphones secure, one would imagine that they would care.
- tedunangst 2y agoWhat's wrong with 3DES?
- hiatus 2y agohttps://csrc.nist.gov/News/2017/Update-to-Current-Use-and-Deprecation-of-TDEA https://csrc.nist.gov/News/2017/Update-to-Current-Use-and-De...
- anotherhue 2y agoIt's been slowly phased out for some time, so to see it appear in a net-new project is highly unusual. Here's just a random example of it being removed back in 2016 https://cvsweb.openbsd.org/src/usr.bin/ssh/myproposal.h?rev=1.52&content-type=text/x-cvsweb-markup https://cvsweb.openbsd.org/src/usr.bin/ssh/myproposal.h?rev=...
- ziddoap 2y ago>Sweet32: Birthday attacks on 64-bit block ciphers in TLS and OpenVPN >CVE-2016-2183, CVE-2016-6329 >[...] short block size makes a block cipher vulnerable to birthday attacks, even if there are no cryptographic attacks against the block cipher itself. We observe that such attacks have now become practical for the common usage of 64-bit block ciphers >We show that a network attacker who can monitor a long-lived Triple-DES HTTPS connection between a web browser and a website can recover secure HTTP cookies https://sweet32.info/ https://sweet32.info/
- t1234s 2y agoIs this a flaw or feature that allows government spying?
- deleted 2y ago[deleted]