Key Reinstallation Attacks – Breaking WPA2 by Forcing Nonce Reuse

Re:Key Reinstallation Attacks – Breaking WPA2 by Forcing Non... by mimi89999 on Monday October 16, 2017 @07:45AM (#15482520)

3 months is more of a joke than a reasonable time, but one can argue about that if he wants...

> even users of non-proprietary projects

Actually many FOSS projects get only notified on the disclosure date.

Hiding the vulnerability for such a long time makes more harm good. The vulnerability can potentially be exploited by security agencies that necessarily know about them and could also be leaked to a bad actor by an employee of one the vendors.

Hopefully WPA2 isn't that important, but potentially security sensitive users trusted something that was known by some to be vulnerable for 3 months! Bad actors could have used it against them.

The embargo resulted in potentially bad actors knowing about the issue, but not vulnerable users.

[ Parent | on HN ]

Re:Key Reinstallation Attacks – Breaking WPA2 by Forcing Non... by user5994461 on Monday October 16, 2017 @08:02AM (#15482585)

The state actor should be least of your worries compared to the millions of script kiddies would could use the vulnerability once it is disclosed publicly.

[ Parent | on HN ]

Re:Key Reinstallation Attacks – Breaking WPA2 by Forcing Non... by mimi89999 on Monday October 16, 2017 @08:47AM (#15482798)

No as I would know about it by following security news?

[ Parent | on HN ]

Re:Key Reinstallation Attacks – Breaking WPA2 by Forcing Non... by user5994461 on Monday October 16, 2017 @09:00AM (#15482853)

Are you so great that you know all the vulnerabilities all the time since the second of disclosure?

Do you seriously expect the other billions of people on the planet to be that great too?

[ Parent | on HN ]

Re:Key Reinstallation Attacks – Breaking WPA2 by Forcing Non... by mimi89999 on Monday October 16, 2017 @09:27AM (#15482976)

For most of them the day after, when I get a notification from my RSS app...

No. I also don't expect them to choose device based on security. That is very bad as vendors won't care about patching their older devices (look at Android devices, home routers...) and vendors won't care about patching their flagship devices fast as they have the possibility to request very long embargos.

Making compromises for those vendors and giving more time for security agencies and other bad actors to silently exploit the vulnerabilities (where FOSS projects would have made patches for users that care) is not the way to go. That philosophy actually makes everybody less safe.

[ Parent | on HN ]