U tweetove putem weba ili aplikacija drugih proizvođača možete dodati podatke o lokaciji, kao što su grad ili točna lokacija. Povijest lokacija tweetova uvijek možete izbrisati. Saznajte više
I know it’s trite to say this (again). But if the cryptographic A-team is willing to accept random elliptic curve parameters from strangers, imagine what kind of mistakes the B-team will make when you ask them to design crypto backdoors.
Every time we have these backdoor discussions, people say “we basically know how to build secure systems,” like it’s just a matter of willpower or something. The truth is we don’t know how to build our existing systems securely at all.
And no, this isn’t just a question of “knowing a little crypto” and “knowing a lot about secure software”, because the weird crypto bugs are the ones Microsoft needs the NSA to find.
Serious question: at what point did anyone think it was a good idea for X.509 to include support for arbitrary, custom EC parameters?
I think(?) the idea was that if we wanted to add more EC curves at a later date we could, without needing to add new constants or new fields. The problem of course is that implementations just accepted any arbitrary values.
Ok but how do we know someone didn’t pay or infiltrate the A team to intentionally add that behavior?
Is that excluded from the crypto backdoors threat model?
Seems like a valuable exploit for them, so what motivated the release? Could it be that another threat actor had found it too, and started to use it against US targets. (Pure speculation on my part, to be clear!)
Interestingly enough, noted similarly re net consequencehttps://twitter.com/daniel_bilar/status/1156206275333697536 …
What a #CENNZ-ible visualization!
Twitter je možda preopterećen ili ima kratkotrajnih poteškoća u radu. Pokušajte ponovno ili potražite dodatne informacije u odjeljku Status Twittera.
