LivingSocial Hacked – 50 Million Customers Affected

Re:LivingSocial Hacked – 50 Million Customers Affected by rmc on Friday April 26, 2013 @07:22PM (#5616080)

You're presuming that "obscure or trivial modification" to a hashing algorithm would be just as secure (or just as vulnerable) as the original. That is no guarantee. It's entirely possible that you might fundamentally break the algorithm and make it much much less secure.

This secure stuff is hard. Remember when debian made a "simple fix" to open ssh and made all the ssh keys for 2 years brute forcible? Do you think you can do better? It's wiser to leave this to the experts

[ Parent | on HN ]

Re:LivingSocial Hacked – 50 Million Customers Affected by marshray on Saturday April 27, 2013 @10:33PM (#5619925)

Debian made a dumb software coding mistake that broke entropy input into OpenSSL's RNG. This is a part of the code that's very hard to test for correctness because by its nature, it must behave unpredictably.

This could have (and often does) happen to any software. It's not a good example of someone attempting to design their own or modify an existing crypto primitive algorithm.

[ Parent | on HN ]

Re:LivingSocial Hacked – 50 Million Customers Affected by rmc on Sunday April 28, 2013 @02:18PM (#5622152)

It's a good example of how someone can look at an algorithm/software and not realise what bits are critically important. "Oh this bit I can change without anything bad happening". It shows there are unknown unknowns in security.

[ Parent | on HN ]

Re:LivingSocial Hacked – 50 Million Customers Affected by marshray on Monday April 29, 2013 @04:12PM (#5628383)

Well the Debian maintainer did realize this was important and emailed the OpenSSL developers. But due to a tragi-comedic miscommunication the breaking change got committed anyway.

[ Parent | on HN ]