Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How a Google Headhunter’s E-Mail Unraveled a Massive Net Security Hole

wired.com

Post reply on HN
Print view View original

31–40 of 107 posts

Re: How a Google Headhunter’s E-Mail Unraveled a Massive Net Security Hole

#31

Post by Evbn »

seanica wrote: post #21
philh wrote: post #17

Earlier quoted context omitted.

The article did not become propaganda.

The article up to that point was great. However, that sentence "But the government of Iran probably could" made the preceding paragraphs appear to be a vehicle to deliver a meme (like a shaggy-dog story). The rest of the article could have been great, I just stopped reading. The journalist could have made a neutral statement about what entities have the resources to crack a 768-bit key. But they or their editor chose…

Unintentional still feeds into the problem. Journos should be extra careful, the have a microphone.

Re: How a Google Headhunter’s E-Mail Unraveled a Massive Net Security Hole

#32

Post by rsingel »

tptacek wrote: post #8

DKIM is an anti-spam mechanism. It does not authenticate the sender of an email message; to do that, use something like PGP. This is an interesting story, but it's not a story about a "massive net security hole". Mail on the Internet has always been spoofable.

Are you saying that 1) anti-spam is not about about security and that 2) DKIM, even if properly implemented, doesn't make spoofing harder and security better?

Re: How a Google Headhunter’s E-Mail Unraveled a Massive Net Security Hole

#33

Post by alexchamberlain »

tptacek wrote: post #28
alexchamberlain wrote: post #26

Earlier quoted context omitted.

It authenticates the domain of the sender, right?

If you want to impute that much authority to it, sure, but the actual signature verification depends on the insecure DNS anyways. Do not make security decisions based on DKIM. It's an anti-spam mechanism and that's all.

My personal opinion is that all email should be considered from a random person.

Re: How a Google Headhunter’s E-Mail Unraveled a Massive Net Security Hole

#34

Post by tptacek »

alexchamberlain wrote: post #33
tptacek wrote: post #28

Earlier quoted context omitted.

If you want to impute that much authority to it, sure, but the actual signature verification depends on the insecure DNS anyways. Do not make security decisions based on DKIM. It's an anti-spam mechanism and that's all.

My personal opinion is that all email should be considered from a random person.

I tend to agree, and further suggest that DKIM shouldn't really change that calculation.

Re: How a Google Headhunter’s E-Mail Unraveled a Massive Net Security Hole

#35

Post by tptacek »

rsingel wrote: post #32
tptacek wrote: post #8

DKIM is an anti-spam mechanism. It does not authenticate the sender of an email message; to do that, use something like PGP. This is an interesting story, but it's not a story about a "massive net security hole". Mail on the Internet has always been spoofable.

Are you saying that 1) anti-spam is not about about security and that 2) DKIM, even if properly implemented, doesn't make spoofing harder and security better?

I'm saying that DKIM is an anti-spam mechanism, and that there are real ways to authenticate the actual sender of a message, like PGP or S/MIME. Calling a cracked DKIM key a "massive Internet security hole" is like calling a bug in SpamAssassin a "massive Internet security hole".

Re: How a Google Headhunter’s E-Mail Unraveled a Massive Net Security Hole

#36

Post by Evbn »

Props to Wired for disclosing that their silly phony photo setups are phony. I found that comforting.

Props to Google for fixing the problem instantly.

Weird that he thought the email was phony based on content. Who wouldn't want a computer savvy math genius on their team? Google has lots.

Re: How a Google Headhunter’s E-Mail Unraveled a Massive Net Security Hole

#37

Post by Evbn »

jgrahamc wrote: post #10

Seriously old news... I attacked Facebook's 512 bit DKIM key back in 2010: http://blog.jgc.org/2010/06/facebooks-dkim-rsa-key-should-be...

So this is one key, used for all a domain's email for a long time, right? How lazy must you be to use an under specced key?

Re: How a Google Headhunter’s E-Mail Unraveled a Massive Net Security Hole

#38

Post by meshko »

Evbn wrote: post #36

Props to Wired for disclosing that their silly phony photo setups are phony. I found that comforting. Props to Google for fixing the problem instantly. Weird that he thought the email was phony based on content. Who wouldn't want a computer savvy math genius on their team? Google has lots.

Google very rarely hires pure mathematicians AFAIK.

Re: How a Google Headhunter’s E-Mail Unraveled a Massive Net Security Hole

#39

Post by tptacek »

Sami_Lehtinen wrote: post #24

Well, afaik key length isn't the problem. Weak algo is. I assume they use RSA, they should use ECC. 512 bits is more than enough. https://www.nsa.gov/business/programs/elliptic_curve.shtml

You can't use ECC for DKIM.
Post reply on HN