News for hackers. Stuff that matters.

A comment on Umbra Privacy Platform. Parent comment

Re:Umbra Privacy Platform by CiPHPerCoder on Tuesday September 06, 2016 @04:53PM (#12439222)
Yes: Aside from being a userspace CSPRNG (which is an additional risk of failure over the kernel's CSPRNG and doesn't provide defense-in-depth), it isn't thread-safe.

https://github.com/ramsey/uuid/issues/80

https://github.com/nodejs/node/issues/5798

There are also some recent IACR papers (linked in the Node thread), but those are the two biggest concerns.

[ Parent | on HN ]
Re:Umbra Privacy Platform by kewde on Tuesday September 06, 2016 @05:46PM (#12439501)
Thank you CiPHPerCoder!

That link to NodeJS was a good read, I'm fairly convinced that we should ditch RAND_bytes from OpenSSL for something more secure, we'll look into LibSodium.

I've caught rumours of a possible RAND_sys_bytes which operates over the systems CSPRNG? We like to be conservative on the libs.

We'd like to tip you for your efforts, do you have a Bitcoin (or ShadowCash) address?

[ Parent | on HN ]
Re:Umbra Privacy Platform by CiPHPerCoder on Tuesday September 06, 2016 @11:39PM (#12440842)
I do, actually, but I haven't accessed it in almost two years. EDIT: And I forgot my password. Here's a new one:

  1D6RMsgnTAf2GLWpD91EaQvQ5ppuaZKkGT
[ Parent | on HN ]