Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

New vuln in Apple M-series allowing secret keys extraction can't be patched

twitter.com

Post reply on HN
Print view View original

141–145 of 145 posts

Re: New vuln in Apple M-series allowing secret keys extraction can't be patched

#141

Post by snvzz »

colejohnson66 wrote: post #79
xpuente wrote: post #76

Security through obscurity is really a bad idea, and Apple is no exception. In the long run, this will likely drive the adoption of RiscV as a better alternative.

This RISC-V evangelism is worrying. Using RISC-V doesn't make your system secure; Good ISA implementations do. The ISA has no bearing on security vulnerabilities. Perhaps a faulty decoder could be a vulnerability vector, but a faulty RISC-V decoder wouldn't be compliant, and neither would a faulty ARM decoder. If I add a custom crypto extension to a RISC-V core and implement it badly, is that the fault of RISC-V? No!…

>The ISA has no bearing on security vulnerabilities.

Complexity leads to bugs, some of which are going to be security bugs.

ISAs impose complexity upon implementations. To claim they do not matter would be disingenuous.

Re: New vuln in Apple M-series allowing secret keys extraction can't be patched

#142

Post by eru »

dagmx wrote: post #132
sofixa wrote: post #67

Earlier quoted context omitted.

I know you're exaggerating because car prices in Singapore are very high (with good reason and kudos to the Singapore government for handling this well), but it's not true: There are a bunch of second hand cars below 6000 Singapore Dollars on this website[1], which is the price of the 64GB/1TB Mac Studio[2]. 1 - https://www.sgcarmart.com/used_cars/listing.php?MOD=&PRC=18&... 2 - https://www.apple.com/sg/shop/buy-mac/…

If you’re looking at second hand cars to make your point, shouldn’t you also look at second hand computers too? Also why look at a mid tier upgrade spec when you’re looking at a bottom tier car?

> If you’re looking at second hand cars to make your point, shouldn’t you also look at second hand computers too?

Nah, my cheeky statement didn't talk specifically about new cars only. So it's only fair to look at second hand cars.

I was specifically talking about the most expensive Apple products vs the least expensive cars.

Re: New vuln in Apple M-series allowing secret keys extraction can't be patched

#143

Post by eru »

coolspot wrote: post #135
sofixa wrote: post #67

Earlier quoted context omitted.

I know you're exaggerating because car prices in Singapore are very high (with good reason and kudos to the Singapore government for handling this well), but it's not true: There are a bunch of second hand cars below 6000 Singapore Dollars on this website[1], which is the price of the 64GB/1TB Mac Studio[2]. 1 - https://www.sgcarmart.com/used_cars/listing.php?MOD=&PRC=18&... 2 - https://www.apple.com/sg/shop/buy-mac/…

You forgot one little thing that you need to buy a car, which is the Certificate of Entitlement that you need to own a car in Singapore. So it is $6,000 (car) + $100,000 (CoE)

You are right in principle. However, CoE is actually a bit less expensive at the moment. See https://www.motorist.sg/coe-results

Re: New vuln in Apple M-series allowing secret keys extraction can't be patched

#144

Post by eru »

tsimionescu wrote: post #48
eru wrote: post #42

Earlier quoted context omitted.

> In contrast, the timing of virtually any email operation is not dependent on the contents of the email, other than the size. What about spell checkers etc? Or even just whatever runs to figure out where to break the lines?

Perhaps those could be attacked. It's possible though that it's not feasible, that the possible inputs leading to a certain timing signature are just too many to get any data out of it. Consider that those programs are not making any effort whatsoever to run in constant time, and yet no one has shown any timing attack against them. OpenSSL has taken great pains to have constant execution time, and yet subtle processo…

> It's possible though that it's not feasible, that the possible inputs leading to a certain timing signature are just too many to get any data out of it.

That's plausible, but a very different argument from the original, that read:

> In contrast, the timing of virtually any email operation is not dependent on the contents of the email, other than the size.

Re: New vuln in Apple M-series allowing secret keys extraction can't be patched

#145

Post by nextlevelwizard »

Kluggy wrote: post #16
VeejayRampay wrote: post #2

if this is confirmed I'm really interested into how exactly Apple will somehow deflect this and make it vanish like they somehow always manage to do with the myriad of issues they're facing over and over

It’s a total non issue for the majority of folks. It requires local access and takes hours under very specific conditions that don’t apply to most people. How often do you run a server that will run arbitrary crypto operations on attacker controlled inputs? Plus all the secrets in the Secure Enclave are immune to this attack, so your FileVault keys and your Apple Pay cards and all that jazz are completely safe. It su…

>It requires local access

What does this mean? All I read is access to user space. Wouldn’t any web browser be enough?

Post reply on HN