News for hackers. Stuff that matters.

A comment on The Catch 22 of Base64: Attacker Dilemma from a Defender Point of View.

Re:The Catch 22 of Base64: Attacker Dilemma from a Defender ... by loup-vaillant on Tuesday May 01, 2018 @02:08PM (#16969659)
> While Base64 encoding is very useful to transfer binary data over the web

This part I cannot fathom. The era of 7-bit bytes is over. What can possibly justify the need for a "printable characters" encoding now? Something stupid like putting data in a JSON string? What's the next step, base-64 encode the JSON containing that string and put it in an XML tag?

[ Parent | on HN ]
Re:The Catch 22 of Base64: Attacker Dilemma from a Defender ... by dylz on Tuesday May 01, 2018 @02:19PM (#16969770)
I see crap like:

  <data><![CDATA[PD94bWw+PHdoeS8+PHRoaXNpc2F3ZnVsPjwvcm9vdD4=]]></data>
constantly in real life in 2018
[ Parent | on HN ]
Re:The Catch 22 of Base64: Attacker Dilemma from a Defender ... by jancsika on Tuesday May 01, 2018 @02:42PM (#16970055)
Isn't this likely due to a second-order effect?

For example, there is (was?) a bug in nw.js with using @font-face to specify a font url that is in the same (local) location as the manifest. As a hack I tried specifying the font as a base64-encoded data url. It worked!

I had no use for base64, other than that there exists an interface for specifying data and it takes a base64-encoded string.

[ Parent | on HN ]
Re:The Catch 22 of Base64: Attacker Dilemma from a Defender ... by loup-vaillant on Tuesday May 01, 2018 @02:23PM (#16969817)
Yes, but why? There's a reason for everything, so I guess this serves some purpose, somehow? I guess the ultimate reason is stupidity or bad planning or cut corners, but I'm still curious.

Bonus point if there's a situation where avoiding something like base64 is actually difficult, even in 2018.

[ Parent | on HN ]
Re:The Catch 22 of Base64: Attacker Dilemma from a Defender ... by jessaustin on Tuesday May 01, 2018 @02:36PM (#16969983)
If one wanted to embed a random token in an email, what would one use instead of base64?
[ Parent | on HN ]
Re:The Catch 22 of Base64: Attacker Dilemma from a Defender ... by loup-vaillant on Tuesday May 01, 2018 @04:18PM (#16971094)
Attachments?
[ Parent | on HN ]
Re:The Catch 22 of Base64: Attacker Dilemma from a Defender ... by jessaustin on Tuesday May 01, 2018 @04:45PM (#16971404)
ISTM that amounts to the same thing? MIME is Base64.
[ Parent | on HN ]
Re:The Catch 22 of Base64: Attacker Dilemma from a Defender ... by loup-vaillant on Tuesday May 01, 2018 @06:18PM (#16972257)
<facepalm>
[ Parent | on HN ]
Re:The Catch 22 of Base64: Attacker Dilemma from a Defender ... by 0culus on Tuesday May 01, 2018 @02:23PM (#16969818)
I've seen base64 used to implement "security through obscurity" in web applications. Many times in situations where they could have just used a cryptographic hash and been done with it.
[ Parent | on HN ]