Milk Sad Disclosure
milksad.info
Milk Sad Disclosure
1–10 of 133 posts
Re: Milk Sad Disclosure
#2Seems a bit overkill with a brand + domain name for every new vulnerability.
Don't get me wrong, it's a nice find and all, but I'm really distracted by all the fluff.
Re: Milk Sad Disclosure
#3Seems a bit overkill with a brand + domain name for every new vulnerability. Don't get me wrong, it's a nice find and all, but I'm really distracted by all the fluff.
That's on you, though. The name doesn't cost anything, but it does make the vulnerability easier to talk about.
Re: Milk Sad Disclosure
#4Are any of the following two things true:
Multi signature addresses mitigate this attack vector?
With the “taproot+schnoor” upgrade last year, it is impossible to tell if funds are stored in a single signature vs multi signature address?
Re: Milk Sad Disclosure
#5Seems a bit overkill with a brand + domain name for every new vulnerability. Don't get me wrong, it's a nice find and all, but I'm really distracted by all the fluff.
That's on you, though. The name doesn't cost anything, but it does make the vulnerability easier to talk about.
I suspect the domain literally cost money...
Re: Milk Sad Disclosure
#6Are any of the following two things true: Multi signature addresses mitigate this attack vector? With the “taproot+schnoor” upgrade last year, it is impossible to tell if funds are stored in a single signature vs multi signature address?
If all the keys were generated with bad entropy, more of them is only buying you some obfuscation.
Re: Milk Sad Disclosure
#7Earlier quoted context omitted.
That's on you, though. The name doesn't cost anything, but it does make the vulnerability easier to talk about.
I suspect the domain literally cost money...
It cost me $4 to help get the word out on a bug that is being actively exploited right now, stealing valuable property. I am good with that.
Re: Milk Sad Disclosure
#8Are any of the following two things true: Multi signature addresses mitigate this attack vector? With the “taproot+schnoor” upgrade last year, it is impossible to tell if funds are stored in a single signature vs multi signature address?
If all the keys were generated with bad entropy, more of them is only buying you some obfuscation.
Generate keys with different apps or methods, for more peace of mind
That was one of the goals of initial multisignature technology in bitcoin, it was about if one of your devices got compromised you could have 2 factor and not approve the transaction. People werent thinking about if your private key generation was compromised, but it works here too
Re: Milk Sad Disclosure
#9"On Libbitcoin Explorer 3.x versions, bx seed uses the Mersenne Twister pseudorandom number generator (PRNG) initialized with 32 bits of system time."
That's a hell of an amateur mistake to make. 50/50 odds whether it was incompetence or deliberate fraud. Maybe 80/20; that flaw is so simple anyone can attack it. Which apparently is happening right now. It's much better if your crypto library generates keys only you can hack.
Re: Milk Sad Disclosure
#10"On Libbitcoin Explorer 3.x versions, bx seed uses the Mersenne Twister pseudorandom number generator (PRNG) initialized with 32 bits of system time." That's a hell of an amateur mistake to make. 50/50 odds whether it was incompetence or deliberate fraud. Maybe 80/20; that flaw is so simple anyone can attack it. Which apparently is happening right now. It's much better if your crypto library generates keys only you c…
if it’s something only you can attack then there is no plausible deniability if you become accused as the code contributor