Yup, confirmed: the ROCA guys deliberately obfuscated their vulnerable key test (and made it slower). This is sad.https://github.com/crocs-muni/roca/issues/39 …
-
-
Replying to @marcan42
Security through obscurity is definitely not useless, like you mention in the comments.
1 reply 0 retweets 0 likes -
Obviously reliance on obscurity is a bad idea, but your assumption that reversing all types of obfuscation is trivial is simply false.
1 reply 0 retweets 0 likes -
Replying to @zbrogz
You can obfuscate all you want, but it's always breakable given enough effort. Commercial products claiming otherwise are snake oil.
1 reply 0 retweets 0 likes -
Of course that doesn't mean you should never do it, since sometimes obfuscation is all you *can* do, but what they've done here is silly.
1 reply 0 retweets 1 like -
Replying to @marcan42
I agree in this particular case, but which is safer, a safe on a street corner or a safe buried in an unknown field?
1 reply 0 retweets 0 likes -
Replying to @zbrogz
Bad analogy; in this world everyone owns a copy of the safe and can make safe-cracking robots for free and combine efforts.
1 reply 0 retweets 0 likes -
Replying to @marcan42
Maybe having access to the same model safe, but not necessarily a copy of the safe with the same contents. That would depend on situation.
1 reply 0 retweets 0 likes
For obfuscation it's always a copy of the safe with the same contents. Otherwise there is other security involved. Obfuscation is cloneable.
-
-
Replying to @marcan42
Maybe we have a different understanding of what "security by obscurity" means. Consider: place an encrypted file on obscure url vs obvious
1 reply 0 retweets 0 likes -
Replying to @zbrogz
That's actually not obscurity, it's real security (akin to a password), assuming no directory listing etc.
1 reply 0 retweets 0 likes - Show replies
New conversation -
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.