Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Oxy – A Security Focused Remote Access Tool

oxy-secure.app

Post reply on HN
Print view View original

11–20 of 88 posts

Re: Oxy – A Security Focused Remote Access Tool

#12

Post by code_duck »

raesene9 wrote: post #5

This is interesting, but shows some of the problems with the word "secure" The app. promises to be more secure than OpenSSH and provides a number of reasons why it thinks it will be. However the site is entirely anonymous, so you have no idea who wrote this tool and what their affiliations or background are. So either you audit the code to get some assurance, or you trust the author(s) without any evidence. Also the…

I'd consider it primarily a source release. Since source is available, of course you should audit it, or at least glance over it before compiling.

Re: Oxy – A Security Focused Remote Access Tool

#13

Post by nine_k »

jandrese wrote: post #8
chinarulezzz wrote: post #2

>Memory Safe + Fast $ grep 'unsafe {' -R ~/oxy --include=*.rs | wc -l 13 Not bad.

It's a good start, but the problems with SSH lately have largely been things like timing attacks that even the smartest compiler won't catch. In fact a smart optimizing compiler can make that even harder to avoid since it is more difficult to know exactly what machine code it will produce.

I wonder how efficient a counter-measure would be adding small random delays in every part of code, possibly injected at MIR or LLVM level. It might drown any timing information in random noise.

They will definitely lower the performance, but likely a bit slower and more secure connection process is preferable to a less secure one.

Re: Oxy – A Security Focused Remote Access Tool

#14

Post by ryanong »

jandrese wrote: post #8
chinarulezzz wrote: post #2

>Memory Safe + Fast $ grep 'unsafe {' -R ~/oxy --include=*.rs | wc -l 13 Not bad.

It's a good start, but the problems with SSH lately have largely been things like timing attacks that even the smartest compiler won't catch. In fact a smart optimizing compiler can make that even harder to avoid since it is more difficult to know exactly what machine code it will produce.

I thought timing attacks only matter for clear data to encrypted data and back part of the library, and as long as they didn’t write any data parsing that is content specific pre or post encryption their encryption and didn’t write their own encryption then there shouldn’t be any major holes.

Re: Oxy – A Security Focused Remote Access Tool

#16

Post by ryanong »

nine_k wrote: post #13
jandrese wrote: post #8

Earlier quoted context omitted.

It's a good start, but the problems with SSH lately have largely been things like timing attacks that even the smartest compiler won't catch. In fact a smart optimizing compiler can make that even harder to avoid since it is more difficult to know exactly what machine code it will produce.

I wonder how efficient a counter-measure would be adding small random delays in every part of code, possibly injected at MIR or LLVM level. It might drown any timing information in random noise. They will definitely lower the performance, but likely a bit slower and more secure connection process is preferable to a less secure one.

From my current understanding adding random noise doesn’t affect most timing attacks because it is averaged out. I may be wrong though

Re: Oxy – A Security Focused Remote Access Tool

#17

Post by omeid2 »

chinarulezzz wrote: post #2

>Memory Safe + Fast $ grep 'unsafe {' -R ~/oxy --include=*.rs | wc -l 13 Not bad.

That is not bad after all, I am not bashing oxy, haven't studied it yet, but don't forget that the dependencies could be using more, and there is a fair few of them[0].

https://github.com/oxy-secure/oxy/blob/571ef12199f8b0f3eca55...

Post reply on HN