141–150 of 166 posts
Earlier quoted context omitted.
> Closed source Ah, so we'll just have to trust you that it's doing anything at all, then.
" Please respond to the strongest plausible interpretation of what someone says, not a weaker one that's easier to criticize. Assume good faith. " https://news.ycombinator.com/newsguidelines.html
Could password managers like 1Password (AgileBits Inc.) employ similar techniques? They seem to make very little effort in this regards. E.g. on 1Password, https://discussions.agilebits.com/discussion/101551/article-... .
1. I created a new test-entry with a long and random password.
2. Opened the process's memory in the HxD hexeditor.
3. Ctrl+f
4. Found this password 4 times.
Even after i locked KeePass i still found the password 2 times.
This is bad!
Earlier quoted context omitted.
" Please respond to the strongest plausible interpretation of what someone says, not a weaker one that's easier to criticize. Assume good faith. " https://news.ycombinator.com/newsguidelines.html
> "Please respond to the strongest plausible interpretation of what someone says, not a weaker one that's easier to criticize. Assume good faith." > https://news.ycombinator.com/newsguidelines.html Forgive me but can we not be skeptical of claims made about a commercial product?
It's also not helpful to post such a clichéd dismissal of what someone else says or their work. That's in the site guidelines too.
RAM encryption for sensitive data is overlooked in so many applications, even "highly secure" applications like veracrypt [0] only recently started adding it. In my opinion server-applications of all sorts should encrypt their private keys by default; this makes cold-boot attacks and other memory-escape attacks so much harder, since now two totally unrelated memory chunks have to be combined in order to retrieve the…
Could password managers like 1Password (AgileBits Inc.) employ similar techniques? They seem to make very little effort in this regards. E.g. on 1Password, https://discussions.agilebits.com/discussion/101551/article-... .
Earlier quoted context omitted.
Could this be implemented at the OS level, i.e. whenever a proces launches, the OS generates a key that it will keep to itself and use to transparently encrypt all memory allocated by that process?
Possibly, but memory is accessed using plain CPU instructions, so it would be hard to transparently encrypt all memory for an application at the kernel level. You do have virtual memory, but I dont think that could be leveraged for this. But who knows whats possible there, maybe if you align and address each memory value at the page boundaries and always force a page fault you could have a really poor implementation…
Note: inside the enclave there is a performance loss but that's due to MAC checks. If you just want encryption without integrity against tampering you don't need that.
Earlier quoted context omitted.
The prekey is hashed into the symmetric key. Both the hash function and the symmetric cipher have avalanche effects that mean that N bit errors require the attacker to bruteforce 2^N combinations. unprotected RSA keys on the other hand have structure and are dense in memory. That means fewer bit-errors and and the ability to guess the missing bits faster than O(2^N).
Yeah but my concern was about direct leakage not brute force. That's what Spectre is about.
RAM encryption for sensitive data is overlooked in so many applications, even "highly secure" applications like veracrypt [0] only recently started adding it. In my opinion server-applications of all sorts should encrypt their private keys by default; this makes cold-boot attacks and other memory-escape attacks so much harder, since now two totally unrelated memory chunks have to be combined in order to retrieve the…
Narrator: It hasn’t.