3 ms·

I'll confess I don't see the purpose of this post -- it contains no actionable information (you certainly shouldn't choose not to update your keys based on this

by zorpner 13y ago

I'll confess I don't see the purpose of this post -- it contains no actionable information (you certainly shouldn't choose not to update your keys based on this analysis that it's somewhat unlikely for a key to leak). And as jasonwatkinspdx points out, multiple people have confirmed that they've been able to extract keys. Memory allocation analyses like these can be quite interesting, but this one seems rushed, potentially dangerous (if it encouraged anyone to not replace their key), and not particularly insightful.

herghost 13y ago
Until there is final proof and production of sufficient evidence, this post is as valid as the claims that information was extracted. Whilst I completely agree that if taken as a reason not to update this is unhelpful, the OP isn't enumerating reasons to not update, he's providing early assessment and commentary. As an industry we've once again not done ourselves any favours with the way this has been handled in the media - it started out as the apocalypse of SSL and all we hold dear, and whilst the update exercise was valid, it appears that the percentage of affected systems was actually quite low and the extent of the apocalypse might well have been overstated. That's not to say there isn't a problem here, by any means - I've spent all day scanning servers and quietly weeping as I watched usernames and passwords dance around my screen - but getting to the analysis of what actually happened should have started before the headlines ran away with themselves.