News for hackers. Stuff that matters.

A comment on Key Reinstallation Attacks – Breaking WPA2 by Forcing Nonce Reuse. Parent comment

Re:Key Reinstallation Attacks – Breaking WPA2 by Forcing Non... by philippnagel on Monday October 16, 2017 @05:43AM (#15481994)
As a user I am completely fine with that.
[ Parent | on HN ]
Re:Key Reinstallation Attacks – Breaking WPA2 by Forcing Non... by nasduia on Monday October 16, 2017 @05:53AM (#15482026)
Even when the author states that now as a result of that selfishness OpenBSD won't get notified about vulnerabilities until well after everyone else?
[ Parent | on HN ]
Re:Key Reinstallation Attacks – Breaking WPA2 by Forcing Non... by temprature on Monday October 16, 2017 @07:05AM (#15482361)
> OpenBSD won't get notified about vulnerabilities until well after everyone else

Which doesn't make a difference if OpenBSD still gets their patch out at the same time as everyone else. Unlike other vendors, it doesn't take OpenBSD four months to go from vulnerability notification to patch release, if you look at previous disclosure timelines they typically have a patch out in days.

[ Parent | on HN ]
Re:Key Reinstallation Attacks – Breaking WPA2 by Forcing Non... by cjsuk on Monday October 16, 2017 @06:52AM (#15482306)
What about the vulnerabilities that OpenBSD notice? Works both ways. And they have an active interest in such things and have discovered as much as any famous-for-five-minutes security researcher.
[ Parent | on HN ]
Re:Key Reinstallation Attacks – Breaking WPA2 by Forcing Non... by JumpCrisscross on Monday October 16, 2017 @07:13AM (#15482389)
> [OpenBSD] have discovered as much as any famous-for-five-minutes security researcher

TL; DR OpenBSD acted rationally if they'd prefer to go it alone, which seems to be their culture. To their credit, it's worked pretty well so far. But you can't have your cake and eat it too. If they prefer a mad scramble after public disclosure, they'll get it. But they shouldn't get early notice from responsible researchers.

[ Parent | on HN ]
Re:Key Reinstallation Attacks – Breaking WPA2 by Forcing Non... by cjsuk on Monday October 16, 2017 @07:23AM (#15482423)
See my comment here. It sort of replies to this anyway: https://news.ycombinator.com/item?id=15482285

I don't believe that embargo is healthy or responsible! If anything its a monopolising factor.

[ Parent | on HN ]
Re:Key Reinstallation Attacks – Breaking WPA2 by Forcing Non... by abcdef123xyz on Monday October 16, 2017 @03:21PM (#15485927)
It sounds rather like he is trying to blame OpenBSD for his own mistake. As multiple people from OpenBSD have said, he agreed they could apply the fix, so they did. He didn't have to say they could. The fact that CERT persuaded him to extend the embargo later is not their fault.
[ Parent | on HN ]