51–60 of 84 posts
Earlier quoted context omitted.
Yes, but they would be clued in because the SSL certificate wouldn't be valid unless they trust your CA.
That's pretty trivial for parents. "Hey pumpkin, I need to borrow your phone for a second". That said this is something that maybe 0.1% of parents could or would set up.
Earlier quoted context omitted.
To be fair, that demo only works on an uncompressed bitmap image with large areas of solid color. It relies on the fact that identical input blocks encrypt to identical outputs, leading to visible repeating patterns. In a format like JPEG, which has an entropy-coding stage and all kinds of internal headers, the chance of encountering two identical blocks in a file is miniscule. Of course ECB is still a very bad choic…
I don't know a lot about the specifics of JPG file format, but... with a complex file format you can probably make some educated guesses about the content of some of the blocks and perhaps start building up a sort of dictionary... ? Yeah, ECB is BAD.
Man, I was hoping it was written in C, or at least C++, not Python.
For tools and toys that are not performance sensitive, python is great. It's a lot more expressive and requires a lot less boilerplate code.
I've re-written projects from C->Python before and had them work with 30% the number of LoC. I've re-written projects from Python->C before and had a 10-fold speed increase.
Right tool for the right job and all that...
Earlier quoted context omitted.
I don't know a lot about the specifics of JPG file format, but... with a complex file format you can probably make some educated guesses about the content of some of the blocks and perhaps start building up a sort of dictionary... ? Yeah, ECB is BAD.
To the extend that AES is a good random number generator, only if you have a complete dictionary of all blocks. Simply because a random number generator should produce independent output even if you only have a small perturbation in the input. That is, there should be no relation between a completely white block and an one where one of the pixels has a value of 0xfffeff.
Snapchat use ECB as the cipher mode of operation: https://github.com/thebradbain/snapception/blob/781ebb13cd7e... To see why this is a problem, see the ECB-encrypted Tux image on http://en.wikipedia.org/wiki/Block_cipher_mode_of_operation#... Oops.
But snapchat updated its encryption just a couple of days ago: https://github.com/programa-stic/snapchat-decrypt You will need the android id of the phone, which I don't think you can easily get as a man in the middle?
Snapchat's supposed valuation at $10b while they appear to be completely inattentive to the security of their product is hard to reconcile.
It is? Startups are taught to move fast and break things. Security usually requires to be thoughtful and not intentionally ruin stuff. Runs counter to the whole new modern movement.
Snapchat's supposed valuation at $10b while they appear to be completely inattentive to the security of their product is hard to reconcile.
It is? Startups are taught to move fast and break things. Security usually requires to be thoughtful and not intentionally ruin stuff. Runs counter to the whole new modern movement.
Of course there are always security holes, but they should really not be that gaping.
Earlier quoted context omitted.
Yes, but they would be clued in because the SSL certificate wouldn't be valid unless they trust your CA.
Have you met a teenager? They will blindly just click ignore/ok until they can do what they want. an invalid cert error isn't going to stop them unless it actually blocks (rather than warns and lets them proceed)