21–30 of 46 posts
This, somehow, triggered my mind to recall LifeLock's CEO Todd Davis’s public marketing campaign where he displayed his Social Security number on the company website and advertisements to demonstrate the security of his platform, however, the challenge backfired dramatically and he becomes a victim of identity theft on at least 13 separate occasions.
Earlier quoted context omitted.
It means you should not use it for anything important, because it can be decrypted by the public with little effort. If you look back, it has been this way for quite awhile. My gripe is with the clickbait title 'Break Me If You Can' https://nvd.nist.gov/vuln/detail/cve-2016-2183
BREAKMEIFYOUCAN! is the default factory key programmed into every MIFARE Ultralight C chip by NXP.
3DES has been broken for a decade. Nice job putting it all together though.
It has? What exactly do you mean by that?
> Converse curiously; don't cross-examine.
You could have just corrected them and not goaded them into further revealing their ignorance. Yes, they underestimated how difficult it is to crack 3DES. You could have simply told them that.
Earlier quoted context omitted.
It's true that 64 bits was known not to be enough when DES shipped decades ago, but there is some difference between "We know that's a bad idea" and a demo showing why, and so I think I'm OK with the word "broken" in that context. There's a reason POCs matter right? Why you feel comfortable (even though I don't agree) saying multi-threaded Go doesn't have a memory safety problem and yet you wouldn't feel comfortable…
This semantic argument was more plausible before the original commenter claimed 3DES can be "broken with little effort".
Earlier quoted context omitted.
It has? What exactly do you mean by that?
Surely someone who has been here as long as you have understands that this type of behavior is not compatible with the guidelines. > Converse curiously; don't cross-examine. You could have just corrected them and not goaded them into further revealing their ignorance. Yes, they underestimated how difficult it is to crack 3DES. You could have simply told them that.
The thread that ensued, a discussion of what it means for a cipher to be obsoleted or unsafe versus "broken", is an actually-interesting question.
I feel pretty OK about how this went.
Earlier quoted context omitted.
Surely someone who has been here as long as you have understands that this type of behavior is not compatible with the guidelines. > Converse curiously; don't cross-examine. You could have just corrected them and not goaded them into further revealing their ignorance. Yes, they underestimated how difficult it is to crack 3DES. You could have simply told them that.
I have no idea who they are or what they were talking about. I think they're thinking about 3DES used as a password hash. I never in 100 years would have guessed that's where they were coming from. The thread that ensued, a discussion of what it means for a cipher to be obsoleted or unsafe versus "broken", is an actually-interesting question. I feel pretty OK about how this went.
> The DES and Triple DES ciphers, as used in the TLS, SSH, and IPSec protocols and other protocols and products, ...
They're clearly talking about it's use as a cipher. Again, someone who has been here as long as you have should understand that you shouldn't put words in their mouth or be evasive in this way.
The conversation would still have touched on these interesting topics, and would likely have done so more immediately.
Earlier quoted context omitted.
Is this a bit?
Have you tried it?
Triple-DES has 168 bit keys. Even if you use a meet-in-the-middle attack, your attack cost has an exponent of 112 (with an associated memory cost with an exponent of 88).
That's not practically exploitable today.
If you think I'm wrong, here's a single block message encrypted with 3DES, then hex-encoded. Have fun:
924db449f52ea976
Earlier quoted context omitted.
It has? What exactly do you mean by that?
Surely someone who has been here as long as you have understands that this type of behavior is not compatible with the guidelines. > Converse curiously; don't cross-examine. You could have just corrected them and not goaded them into further revealing their ignorance. Yes, they underestimated how difficult it is to crack 3DES. You could have simply told them that.
with a quick google of "3des broken" and reading the first paragraph of wikipedia on 3des, i was able to guess (correctly!) what they original commenter was referring to.
Earlier quoted context omitted.
I have no idea who they are or what they were talking about. I think they're thinking about 3DES used as a password hash. I never in 100 years would have guessed that's where they were coming from. The thread that ensued, a discussion of what it means for a cipher to be obsoleted or unsafe versus "broken", is an actually-interesting question. I feel pretty OK about how this went.
You could never, in a million years, have guessed by "broken" they meant "it can be decrypted by the public with little effort?" I doubt that. I see no evidence they are talking about a password hash. Here's what they actually cited: > The DES and Triple DES ciphers, as used in the TLS, SSH, and IPSec protocols and other protocols and products, ... They're clearly talking about it's use as a cipher. Again, someone wh…