News for hackers. Stuff that matters.

A comment on An anonymous hacker reverse engineered my E2EE. Parent comment

Re:An anonymous hacker reverse engineered my E2EE by SP2njsPl2WmlAwM on Sunday August 15, 2021 @06:24PM (#28193100)
> FWIW, I was expecting something like "the mechanism is fundamentally flawed because the e2e encryption actually is designed in a way where the server can derive or find the key"

The mechanism wasn't intentionally designed that way. But the symmetric ChatKeys were created with Random(), seeded (at least partially) with time().

[ Parent | on HN ]
Re:An anonymous hacker reverse engineered my E2EE by entropic88 on Sunday August 15, 2021 @10:37PM (#28194455)
This recently happened with a Bitcoin wallet app called Cake wallet. They used time() in their random number generator which allowed the key generation to be replicated and funds stolen.
[ Parent | on HN ]
Re:An anonymous hacker reverse engineered my E2EE by suifbwish on Tuesday August 17, 2021 @01:23PM (#28212424)
What’s wrong with just using /dev/urandom for the entropy pool?
[ Parent | on HN ]