Private key redaction: Ur doin it rong (2020) • Hacker News Board

Re: Private key redaction: Ur doin it rong (2020)

#31

Post by schoen » Mon, Jun 12, 2023, 10:36 PM UTC

Phemist wrote: post #11

Pet peeve: similar thing goes for QR-code redaction. People nearly always block out the middle part of the QR-code. However, actual information, the zigzag pattern, starts from the bottom-right. For many QR-code versions, the middle part encode _mostly_ ECC blocks, which are by definition redundant. The fact that a QR-code doesn't decode in the regular scanning apps does not mean you cannot read any information from…

I think I've seen both CTF levels and puzzlehunt puzzles based on partially obscuring a QR code, precisely so that it "doesn't decode in the regular scanning apps", and then challenging people to read it anyway.

Re: Private key redaction: Ur doin it rong (2020)

#32

Post by dang » Mon, Jun 12, 2023, 10:38 PM UTC

rendaw wrote: post #8

dang wrote: post #6

Earlier quoted context omitted.

Thanks. How about we change the URL to the more general article, which has more information and doesn't shame anybody. I've changed it from https://www.hezmatt.org/~mpalmer/blog/2023/06/12/private-key... now.

The original article is also shaming someone, although from 3 years ago maybe it's less an issue now (?)

Ah - I didn't realize. I hope you're right about the latter.

Re: Private key redaction: Ur doin it rong (2020)

#33

Post by wodenokoto » Tue, Jun 13, 2023, 10:43 AM UTC

electroly wrote: post #28

wodenokoto wrote: post #23

Earlier quoted context omitted.

If you have already generated a second key, which you are not gonna use as a key, then just use that one instead of any redaction.

This has the issue stated at the bottom of the article: someone will eventually copy that as their own private key, even if the author had never used it.

In that case, just retract _any_ part of the key, such that it won’t work if you copy paste it, but still no used secret is revealed.

If a user wants to rebuild the key in order to use it for something, then they must have a very good reason to do so, and it is probably better to just let them do that.

Re: Private key redaction: Ur doin it rong (2020)

#34

Post by electroly » Tue, Jun 13, 2023, 4:14 PM UTC

wodenokoto wrote: post #33

electroly wrote: post #28

Earlier quoted context omitted.

This has the issue stated at the bottom of the article: someone will eventually copy that as their own private key, even if the author had never used it.

In that case, just retract _any_ part of the key, such that it won’t work if you copy paste it, but still no used secret is revealed. If a user wants to rebuild the key in order to use it for something, then they must have a very good reason to do so, and it is probably better to just let them do that.

Posting a screenshot instead of actual text is likely to work in this case, too, even if it's the whole key.