And by the way, the fact that I had to come out and make this explanation is *yet again* another example of the sorry state of tech security reporting, by both media and infosec folks themselves. Like every single article about this bug is wrong and makes no sense.https://twitter.com/marcan42/status/1217803207084134401 …
-
Show this thread
-
I don't understand how everyone is falling into the trap of talking about "validating" ECC params or using the wrong ones or whatever, and completely handwaving the way this actually works. If you *think* about how this should work, it doesn't make sense.
1 reply 1 retweet 7 likesShow this thread -
It just goes on to show that in the absence of detailed official information, people are perfectly happy to make up an explanation without never mind verifying it, but not even trying to see if it is consistent or reasonable! This is wrong.
4 replies 4 retweets 21 likesShow this thread -
Replying to @marcan42
To me this is partially due to an interesting property of this bug: you don't need to know *exactly* what goes wrong in order to produce a (kind of) working exploit. Oh, and people love talking about seemingly cool textbook crypto instead of software engineering (bad) practices.
1 reply 0 retweets 6 likes
Yeah, it's a lot more impressive to talk about how you can use a quirk of ECC math (even though it literally involves no math, just copying a value from A to B) than to talk about how MS messed up the moral equivalent of an .equals method.
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.