News for hackers. Stuff that matters.

A comment on FortiGuard XOR Encryption in Multiple Fortinet Products. Parent comment

Re:FortiGuard XOR Encryption in Multiple Fortinet Products by retSava on Tuesday November 26, 2019 @06:52AM (#21637472)
Well, posting over HTTPS (with the worst certificates removed) instead of HTTP, perhaps with certificate pinning, isn't that hard and goes a long way.
[ Parent | on HN ]
Re:FortiGuard XOR Encryption in Multiple Fortinet Products by tialaramex on Tuesday November 26, 2019 @09:09AM (#21638362)
This "XOR encryption" is vulnerable to an eavesdropper with almost no technical capability.

Even just HTTPS with no checks whatsoever (think 1990s Perl scripts or Python Requests with all the checking explicitly switched off) is protected against eavesdroppers, so that would require an active attacker (or a large quantum computer) to defeat, far more sophisticated than this trivial nonsense.

[ Parent | on HN ]
Re:FortiGuard XOR Encryption in Multiple Fortinet Products by retSava on Thursday November 28, 2019 @04:21AM (#21655764)
Yeah exactly, that's my point - going from "oh shit" to "I feel fairly comfortable" in this case shouldn't take 1.5 years.
[ Parent | on HN ]