News for hackers. Stuff that matters.

A comment on Show HN: OormiPass – free, cross platform and open sourced password manager. Parent comment

Re:Show HN: OormiPass – free, cross platform and open source... by tptacek on Saturday January 26, 2019 @01:35PM (#19007627)
You need to be more careful with your reasoning. It's not always the case that a MAC simply prevents "replacing, trashing, or performing zero-knowledge modifications" on your data. It can be the case that you cannot retain confidentiality without integrity; MACs prevent chosen-ciphertext attacks.
[ Parent | on HN ]
Re:Show HN: OormiPass – free, cross platform and open source... by arghwhat on Sunday January 27, 2019 @06:21AM (#19011303)
While correct that authentication can prevent chosen-ciphertext, I do not see how such an attack could be relevant against an offline password manager. I ignored it for that reason.
[ Parent | on HN ]
Re:Show HN: OormiPass – free, cross platform and open source... by tptacek on Sunday January 27, 2019 @11:28AM (#19012303)
There is also the Efail pattern of attacks, where malleable ciphertext is used to inject active controlled plaintext (HTML tags, different URLs, etc) that exfiltrate the rest of plaintext. Can you rule that out as well?

There's a reason some people call this "the cryptographic doom principle".

[ Parent | on HN ]