Live data from Hacker News

Key Reinstallation Attacks – Breaking WPA2 by Forcing Nonce Reuse

krackattacks.com

421–424 of 424 posts

Re: Key Reinstallation Attacks – Breaking WPA2 by Forcing Nonce Reuse

#421

Earlier quoted context omitted.

This is one of those things that should be better with modern handsets and the security patch level for Android. Hopefully a fix for this is included in the November set. In general most bigger manufacturers have been somewhat decent in updating their flagship devices. With a Sony flagship from the last 18 months for example, you usually won't run more than two months behind on security updates. Samsung is similar if…

I have a HTC 10, a flagship device that's barely a year old the fact that I now have to wait a couple a months for a patch to what is clearly a critical vulnerability is just ridiculous. The fact that anyone without a flagship device should now throw that phone away because it will probably never be patched is despicable. I totally agree with your hope that this will kick both the manufacturers and Google in the butt…

Fortunately the term "flagship" doesn't promise anything about support, patches or security.

It's just a word that means you paid more for having all the bells and whistles that the OEM could offer at the time, instead of going for the next-best model or such.

Fortunately, whether you can afford the best of the best with all the optional extras or a cheaper second-tier model doesn't affect the security of the device. And it shouldn't, because if you can't afford a "flagship" device, doesn't mean you can afford to get hacked either.

Unfortunately, while the security-update frequency ought to be comparable, it turns out that it's mainly comparably bad :-/

Re: Key Reinstallation Attacks – Breaking WPA2 by Forcing Nonce Reuse

#422

Earlier quoted context omitted.

The Nexus 5 was released 4 years ago. At the same time the iPhone 5C was released. The 5C also won't receive a patch for this. There is a problem with handset abandonment, but this is true across all vendors, and it does not underline sequence7's claim that this is solely an Android problem.

> The 5C also won't receive a patch for this. You don't know that. Apple could very well release an iOS 10 update for this.

By that token it's possible the GS2 on Android 4.0.4 might get a patch for this.

But in both cases the stated policy is that the devices will not receive any more updates, either feature or security.

Re: Key Reinstallation Attacks – Breaking WPA2 by Forcing Nonce Reuse

#424

Earlier quoted context omitted.

In principle yes (if it is not against the app store guidelines). But if submitted as an app, it cannot use JIT compiling for security reasons. This will make the speed of JavaScript execution very non-competitive to WebKit.

It's not just JIT. Quoting from https://developer.apple.com/app-store/review/guidelines/ section 2.5.2: Apps should be self-contained in their bundles, and may not read or write data outside the designated container area, nor may they download, install, or execute code, including other apps. So your can't ship a JS interpreter either, even without a JIT. And section 2.5.6: Apps that browse the web must use the approp…

You can ship a JS interpreter, it just can’t download code from the internet and run it (yes this makes shipping a browser in the App Store impossible).

But regardless, with your own device, you can run whatever code you want on it.

Post reply on HN