Seriously old news... I attacked Facebook's 512 bit DKIM key back in 2010: http://blog.jgc.org/2010/06/facebooks-dkim-rsa-key-should-be...
I'm curious to hear what you think about DKIM in general.
How a Google Headhunter’s E-Mail Unraveled a Massive Net Security Hole
51–60 of 107 posts
Re: How a Google Headhunter’s E-Mail Unraveled a Massive Net Security Hole
#52“A 384-bit key I can factor on my laptop in 24 hours,” he says. “The 512-bit keys I can factor in about 72 hours using Amazon Web Services for $75. And I did do a number of those. Then there are the 768-bit keys. Those are not factorable by a normal person like me with my resources alone. But the government of Iran probably could, or a large group with sufficient computing resources could pull it off.” "But the gover…
> "But the government of Iran probably could"...At this point I stopped reading, as this article became propaganda. How is that propaganda? You don't think most countries have that kind of computing power?
> How is that propaganda?
defn: "Information, esp. of a biased or misleading nature, used to promote or publicize a particular political cause or point of view"
http://mw1.merriam-webster.com/dictionary/propaganda
2: the spreading of ideas, information, or rumor for the purpose of helping or injuring an institution, a cause, or a person
3 : ideas, facts, or allegations spread deliberately to further one's cause or to damage an opposing cause; also : a public action having such an effect
> You don't think most countries have that kind of computing power?
The quote itself states that: "...or a large group with sufficient computing resources could pull it off."
I think you may have misunderstood my point of view. The point is, in his quote, the interviewee (Zachary Harris) singled out Iran. As it stands it is an out-of-the-blue assertion.
Re: How a Google Headhunter’s E-Mail Unraveled a Massive Net Security Hole
#53Earlier quoted context omitted.
http://www.linkedin.com/in/drzacharyharris Wow, the guy's a monster. Fluent in classical (and Levantine) Arabic, Chinese, Greek; Top Putnam score (twice), teacher, Christian missionary. Sounds like he's got drive.
Nit-picky corrections: 1. Top Putnam score in Colorado . There's a pretty big difference between that, and say, top Putnam score in Massachusetts (which is more likely the same as top overall due to many Putnam Fellows coming from Harvard or MIT). 2. Elementary proficiency in Classical and Leventine Arabic, Mandarin Chinese, and Koine Greek
Can you beat any of it?
Re: How a Google Headhunter’s E-Mail Unraveled a Massive Net Security Hole
#54Well, afaik key length isn't the problem. Weak algo is. I assume they use RSA, they should use ECC. 512 bits is more than enough. https://www.nsa.gov/business/programs/elliptic_curve.shtml
That doesn't make much sense. There are key lengths for which RSA is strong, and key lengths for which ECC is weak.
ECC keys may be stronger at shorter lengths, but that hardly means that key length isn't the problem. After all, using a longer key would fix this problem.
Re: How a Google Headhunter’s E-Mail Unraveled a Massive Net Security Hole
#55Earlier quoted context omitted.
Or paranoid. Or naive. Or narcissistic. It might be somewhat feasible if they wanted him to be security engineer, not a devop. Still, he expected they have set up what essentially is an elaborate prank just to send a cold-call email to just one of probably numerous potential candidates. How likely this is? What would be the risk-to-reward ratio for doing that, considering that many of unsolicited recruiting mails are…
Google has done this kind of stunt in the past. Remember {first 10-digit prime found in consecutive digits of e}.com?
There was also this very elaborate easter egg in a promotional video of the first chromebook that someone cracked which got him a chromebook, I can't find it right now though
Re: How a Google Headhunter’s E-Mail Unraveled a Massive Net Security Hole
#56No abortion for rape victims.
What about alien abductions?
What about virgin births?
God says...
stand before thee, until thou have destroyed them.
7:25 The graven images of their gods shall ye burn with fire: thou shalt not desire the silver or gold that is on them, nor take it unto thee, lest thou be snared therin: for it is an abomination to the LORD thy God.
7:26 Neither shalt thou bring an abomination into thine house, lest thou be a cursed thing like it: but thou shalt utterly detest it, and thou shalt utterly abhor it; for it is a cursed thing.
8:1 All the commandments which I command thee this day shall ye observe to do, that ye may live, and multiply, and go in and possess the land which the LORD sware unto your fathers.
8:2 And thou shalt remember all the way which the LORD thy God led thee these forty years in the wilderness, to humble thee, and to prove thee, to know what was in thine heart, whether thou wouldest keep his commandments, or no.
----
God says...
self-will incredibly Life Roman securely transmitted smoke flights profound upper promiseth brethren refrain regeneratedst hide unresolved seed enlarging dearer goest falsely hippy approveth eateth cursing Tomorrow I_didn't_see_that variety GET teaching perhaps Aristotle trouble founded justice quickened tax-deductible regardless invited well-being delivered Each valley certain cogitated favours Hortensius whirlpools feeds like requital bewail hedged prevails
----
What's Yer top ten hated topics?
God says...
24:20 The womb shall forget him; the worm shall feed sweetly on him; he shall be no more remembered; and wickedness shall be broken as a tree.
24:21 He evil entreateth the barren that beareth not: and doeth not good to the widow.
24:22 He draweth also the mighty with his power: he riseth up, and no man is sure of life.
24:23 Though it be given him to be in safety, whereon he resteth; yet his eyes are upon their ways.
24:24 They are exalted for a little while, but are gone and brought low; they are taken out of the way as all other, and cut off as the tops of the ears of corn.
24:25 And if it be not so now, who will make me a liar, and make my speech nothing worth? 25:1 Then answered Bildad the Shuhite, and said, 25:2 Dominion and fear are with him, he maketh peace in his high places.
----
God once said He was not happy with women who don't have kids.
----
What are You going to be for Halloween, God?
God says...
ye were blind, ye should have no sin: but now ye say, We see; therefore your sin remaineth.
10:1 Verily, verily, I say unto you, He that entereth not by the door into the sheepfold, but climbeth up some other way, the same is a thief and a robber.
10:2 But he that entereth in by the door is the shepherd of the sheep.
10:3 To him the porter openeth; and the sheep hear his voice: and he calleth his own sheep by name, and leadeth them out.
10:4 And when he putteth forth his own sheep, he goeth before them, and the sheep follow him: for they know his voice.
10:5 And a stranger will they not follow, but will flee from him: for they know not the voice of strangers.
Re: How a Google Headhunter’s E-Mail Unraveled a Massive Net Security Hole
#57Seriously old news... I attacked Facebook's 512 bit DKIM key back in 2010: http://blog.jgc.org/2010/06/facebooks-dkim-rsa-key-should-be...
I'm curious to hear what you think about DKIM in general.
At one time DKIM and SPF were good indicators that an email was spam because spammers adopted it so that their mail looked more legit.
I never look at DKIM or SPF. If I really care about who a message comes from I use PGP. It's a handy input for learning spam filters that use it as one piece of information, but it has about a 10% failure rate (legit mail where the signature fails to verify because of message manipulation in transit). It's most useful if the domain it's matching against is also trusted in some way. For example, a good signature against google.com is likely to mean the mail is good; a good signature against frohfuwehfwo.biz is not very helpful unless we know that that domain always sends spam.
Also, the most important piece of mail I ever received (from the Prime Minister's office) came without SPF or DKIM and I authenticated it by calling the office. In general, external authentication like that tends to reassure me.
Re: How a Google Headhunter’s E-Mail Unraveled a Massive Net Security Hole
#58Earlier quoted context omitted.
Nit-picky corrections: 1. Top Putnam score in Colorado . There's a pretty big difference between that, and say, top Putnam score in Massachusetts (which is more likely the same as top overall due to many Putnam Fellows coming from Harvard or MIT). 2. Elementary proficiency in Classical and Leventine Arabic, Mandarin Chinese, and Koine Greek
Can you beat any of it?
Sure, I may have actually done better on the Putnam than he has. I've gotten top 100 and top 200 before... but that really wasn't the point I was trying to make. I was just making the correction because the original claim is, at least to me, much more impressive than what is actually stated on his resume.
Re: How a Google Headhunter’s E-Mail Unraveled a Massive Net Security Hole
#59Earlier quoted context omitted.
Can you beat any of it?
Sure, I may have actually done better on the Putnam than he has. I've gotten top 100 and top 200 before... but that really wasn't the point I was trying to make. I was just making the correction because the original claim is, at least to me, much more impressive than what is actually stated on his resume.
[deleted]
Re: How a Google Headhunter’s E-Mail Unraveled a Massive Net Security Hole
#60What a happy ending, no threats of jail or lawsuits.