lvh

83 ms·

811.
by lvh 8y ago
There's more going on than just the SGX attack. What I'm not saying is "add this 1 instruction and everything is copacetic" -- what I am saying is that the patches for at least some of the vulnerabilities are somewhat st
812.
by lvh 8y ago
That's fair -- I was talking about a specific SGX enclave instance, not SGX in general. In particular, you're right that you can only leak things from an SGX instance, but you can't break all future SGX enclaves forever on a
813.
by lvh 8y ago
It is not obvious to me that it's the design warts of x86_64 (wholeheartedly agreed--I don't like x86_64 either) are the cause of the security problems we're seeing. Other architectures also have speculative execution and mul
814.
by lvh 8y ago
asciinema is open source and does this really cool thing where it actually emulates a terminal. asciinema recordings are tiny compared to real video, and get rendered as text by your browser, so everything is sharp and snappy.
815.
by lvh 8y ago
To be clear: HyperThreading is relevant but not a panacea here. Disabling HT helps for the hypervisor leak, and while the Intel microcode changes now incorporate HyperThreading status into key generation, we don't know if that prevents
816.
by lvh 8y ago
AWS bulletin: https://aws.amazon.com/security/security-bulletins/AWS-2018-... . Amazon Linux bulletin: https://alas.aws.amazon.com/ALAS-2018-1058.html RHEL patches are out. CentOS after delay, pres
817.
by lvh 8y ago
This is _bananas_. - Unlike previous speculative execution attacks against SGX, this extracts memory "in parallel" to SGX, instead of attacking the code running in SGX directly. It always works: it doesn't require the SGX cod
818.
by lvh 8y ago
RHEL patches are out. CentOS after delay, presumably. Nothing yet for Debian/Ubuntu.
819.
by lvh 8y ago
AWS bulletin: https://aws.amazon.com/security/security-bulletins/AWS-2018-... Amazon Linux bulletin: https://alas.aws.amazon.com/ALAS-2018-1058.html TL;DR: AWS is patched. Go update your kernel (e
820.
by lvh 8y ago
This is _bananas_. - Unlike previous speculative execution attacks against SGX, this extracts memory "in parallel" to SGX, instead of attacking the code running in SGX directly. It always works: it doesn't require the SGX cod
821.
by lvh 8y ago
The hard parts of voting systems are keeping 1 ratios 1 of voter and vote and preserving individual voter anonymity. Blockchains don't solve either problem better than paper, and if you're not careful you end up introducing subtle
822.
by lvh 8y ago
This leaves out an important part: in sensitive areas like a SCIF. All they’re really saying is that modern smart watches can have similar capability to phones—we don’t allow those, so we shouldn’t allow the new watches either. Pretty strai
823.
by lvh 8y ago
You're correct, but for clarity for those playing along at home: that's just another variant of a cross-signed root. It's not an actual root CA in the sense that I was using it (self-signed): that is still always pointless.
824.
by lvh 8y ago
Until we discover the compromise, yes. We have a few better tools for doing that now, like Certificate Transparency. A number of CAs are effectively under the control of a government: https://ccadb-public.secure.force.com/mo
825.
by lvh 8y ago
No, clearly most people don't pick their passwords from a 10k wordlist. My argument doesn't rely on them doing that: my argument relies on them picking bad passwords. I am using 10k wordlist diceware-style passwords only as an ent
826.
by lvh 8y ago
Some context on how this works: your system (usually OS) ships with a bunch of root certificates that are allowed to sign any certificate (de facto). New CAs need to get in that store to be trusted, but they don't get to be in that sto
827.
by lvh 8y ago
Assuming you set a reasonable ControlPath (the default is reasonable on all platforms) this is fine, sure. Even if you don't, it's fine-ish. Not how you're going to get popped.
828.
by lvh 8y ago
Sure, I think that’s a fine option too.
829.
by lvh 8y ago
I estimated the cost of the pbkdf_bcrypt function that the new OpenSSH format uses. It's about 20-30ms for a derivation with default (nrounds=16) parameters. That's fine, but it's not absurd to suggest you want nrounds=100 or
830.
by lvh 8y ago
Can you elaborate? A lot of the reasons in the article are weak at best; such as the timing attack/off-curve attack FUD for NIST curves. There are a handful of good things in here (I commented elsewhere with a list), but nobody should
831.
by lvh 8y ago
> ECDH curve choice: This eliminates 9-11 because NIST curves suck. They leak secrets through timing side channels and off-curve inputs. Also, NIST is considered harmful and cannot be trusted. This is FUD. If you have an off-curve attack
832.
by lvh 8y ago
Good parts: - Upgrade your keys to the new format. Better: put them on a Yubikey, or use short-lived keys via Teleport or BLESS. - Disable non-key/cert based auth (like passwords). You can do this on both clients and servers if you lik
833.
by lvh 8y ago
If you can put up with GPG cards, gpg-agent knows how to pretend to be an SSH auth socket meaning it can do your signing for you. At key generation time you can dump the key (once!) and then feed it to paperkey as a backup.
834.
by lvh 8y ago
What machine are you SSHing from? My laptop does 200 RSA 4096 signatures per second. 5ms vs 1ms doesn’t seem like a perceptible added latency.
835.
by lvh 8y ago
Yes, we mentioned GitHub repeaatedly in these threads.
836.
by lvh 8y ago
I just spent a bit of time tweaking it; hopefully that's better :)
837.
by lvh 8y ago
Yep; this is an attack on the password-encrypted file. You can't tell if it's leaked or not unless osmeone starts using it. You can tell if it's in the safe format right now by looking at the first few lines of the file.
838.
by lvh 8y ago
I'm not saying it is literally impossible for this to be safe. I'm saying in pratcie, most of the time, it is not. A 120 bit password is not normal.
839.
by lvh 8y ago
FWIW: if you really, really don't want to learn GPG: Yubikeys will also speak PKCS11, it's a separate applet, and they ship PKCS11 libs for every major platform. We've used it for OpenVPN in the past (before we had wireguard)
840.
by lvh 8y ago
I think I’m missing context. You don’t need to migrate from what? If you have reasonable scrypt or bcrypt I’m not gonna tell you to move.

More ›