Re:Why 111-1111111 is a valid Windows 95 key
by AlotOfReading on Sunday February 26, 2023 @04:14PM
(#34949520)
Not if their cryptography is done properly. Cryptosystems are designed to maintain their security even if the complete algorithm is known to the adversary. You'll commonly see this phrased as "don't rely on security through obscurity".
[ Parent
| on HN ]
Re:Why 111-1111111 is a valid Windows 95 key
by ranger_danger on Sunday February 26, 2023 @11:57PM
(#34953151)
> don't rely on security through obscurity
if it's not obscure enough that it will be found, then you are correct.
but what's more secure than a password that you don't know? not knowing there is a password in the first place. if the answer is never found, how can it be insecure? I dub this schrodinger's security.
Re:Why 111-1111111 is a valid Windows 95 key
by staunton on Monday February 27, 2023 @02:24AM
(#34953938)
> don't rely on security through obscurity
Which doesn't mean you shouldn't also use obscurity. NIST recommends it [1], and the industry widely uses it. In practice "don't rely on obscurity" usually means "have enough security besides obscurity to give you a grace period to switch out the obscurity". That's for whole systems, you might get away with people knowing you use standardized primitives like AES.
[1]: https://csrc.nist.gov/news/2021/revised-guidance-for-develop...
Re:Why 111-1111111 is a valid Windows 95 key
by AlotOfReading on Monday February 27, 2023 @12:10PM
(#34958997)
Everything we know about the subject of this discussion (windows product key validation) comes from reverse engineering the relevant DLLs because none of it has been discussed publicly. I think MS is probably of a similar opinion regarding publishing unnecessary details.