Cracking a 512-bit DKIM key for less than $8 in the cloud
dmarcchecker.app
Cracking a 512-bit DKIM key for less than $8 in the cloud
1–10 of 433 posts
Re: Cracking a 512-bit DKIM key for less than $8 in the cloud
#2Technically, this is very nice work.
But as a security generality - email is vastly less secure* than human nature wants to assume that it is. Human nature usually wins.
*Outside of a carefully run org's own network, and a few other edge cases
Re: Cracking a 512-bit DKIM key for less than $8 in the cloud
#3Technically, this is very nice work. But as a security generality - email is vastly less secure* than human nature wants to assume that it is. Human nature usually wins. *Outside of a carefully run org's own network, and a few other edge cases
Yeah, so I guess there's no point in picking any of the low hanging fruit to make it more secure.
Re: Cracking a 512-bit DKIM key for less than $8 in the cloud
#4Some DNS providers suck and only let you set 1024 bit long keys. For example wordpress.com.
Re: Cracking a 512-bit DKIM key for less than $8 in the cloud
#5Technically, this is very nice work. But as a security generality - email is vastly less secure* than human nature wants to assume that it is. Human nature usually wins. *Outside of a carefully run org's own network, and a few other edge cases
>But as a security generality - email is vastly less secure than human nature wants to assume that it is.
I don't think this has to do with "human nature" anymore than http did. It's a very important, powerful form of communication without any secure replacement. Just as we switched to https, ideally an "xmail" or the like would get created as an open standard with open software that was email with better security by default. Sadly I'm not sure we collectively have the ability to do that kind of thing any longer, powerful entities have realized it's just too attractive to lock it up. But even many open source organizations don't seem to feel like bothering. Plenty of security experts even just prefer new shiny and will spout ridiculous "move to instant messaging". So status quo rules for the foreseeable future.
Re: Cracking a 512-bit DKIM key for less than $8 in the cloud
#6Could someone help me understand why we're not dramatically ramping up key sizes across the board on all encryption? Not as a solution, but as a buy-some-time measure.
Compute is rapidly increasing, there is continuous chatter about quantum and yet everyone seems to be just staring at their belly buttons. Obviously bigger keys are more expensive in compute, but we've got more too...why only use it on the cracking side, but not on defense?
Even simple things like forcing TLS 1.3 instead of 1.2 from client side breaks things...including hn site.
Re: Cracking a 512-bit DKIM key for less than $8 in the cloud
#7Technically, this is very nice work. But as a security generality - email is vastly less secure* than human nature wants to assume that it is. Human nature usually wins. *Outside of a carefully run org's own network, and a few other edge cases
As a small mail server admin I see this less about security of messages originating from me and more about the possibility of spammers sending DKIM-authenticated mail as coming from me (and resulting in shadow bans at gmail, etc. which is a huge pain to deal with)
Re: Cracking a 512-bit DKIM key for less than $8 in the cloud
#8How common are such small DKIM keys?
I'm pretty sure mine are 2048-bit, though I'd have to check as they were last set a fair while ago.
Re: Cracking a 512-bit DKIM key for less than $8 in the cloud
#9Could someone help me understand why we're not dramatically ramping up key sizes across the board on all encryption? Not as a solution, but as a buy-some-time measure. Compute is rapidly increasing, there is continuous chatter about quantum and yet everyone seems to be just staring at their belly buttons. Obviously bigger keys are more expensive in compute, but we've got more too...why only use it on the cracking sid…
Because the only way to force their use is to break things, mostly this means transferring the pain directly to the user instead of the service operators in the hope that they will bitch loudly enough for the service operator to care, and this has a good chance of instead causing the user to move to your competitors instead, who will be more than willing to not let a little thing like security get between them and revenue.
Re: Cracking a 512-bit DKIM key for less than $8 in the cloud
#10Could someone help me understand why we're not dramatically ramping up key sizes across the board on all encryption? Not as a solution, but as a buy-some-time measure. Compute is rapidly increasing, there is continuous chatter about quantum and yet everyone seems to be just staring at their belly buttons. Obviously bigger keys are more expensive in compute, but we've got more too...why only use it on the cracking sid…
> why we're not dramatically ramping up key sizes across the board on all encryption?
because no one thinks there is a reason to, no one has any fear that classical computers will catch up with RSA-2048/AES-128 before their grand children are dead.
post-quantum crypt stuff is happening and people are planning how to migrate to it.