News for hackers. Stuff that matters.

A comment on Why XSS is serious business (and why Tesco needs to pay attention). Parent comment

Re:Why XSS is serious business (and why Tesco needs to pay a... by tptacek on Monday August 20, 2012 @11:38AM (#4408068)
Flipping bits in CBC ciphertexts works just fine without the IV.
[ Parent | on HN ]
Re:Why XSS is serious business (and why Tesco needs to pay a... by AnIrishDuck on Monday August 20, 2012 @12:07PM (#4408226)
Right... I was assuming in this case that the message size would be < 1 block considering it's just a database id. In that case you'd have to modify the IV to flip id bits.
[ Parent | on HN ]