News for hackers. Stuff that matters.

A comment on LivingSocial Hacked – 50 Million Customers Affected. Parent comment

Re:LivingSocial Hacked – 50 Million Customers Affected by marshray on Saturday April 27, 2013 @10:33PM (#5619925)
Debian made a dumb software coding mistake that broke entropy input into OpenSSL's RNG. This is a part of the code that's very hard to test for correctness because by its nature, it must behave unpredictably.

This could have (and often does) happen to any software. It's not a good example of someone attempting to design their own or modify an existing crypto primitive algorithm.

[ Parent | on HN ]
Re:LivingSocial Hacked – 50 Million Customers Affected by rmc on Sunday April 28, 2013 @02:18PM (#5622152)
It's a good example of how someone can look at an algorithm/software and not realise what bits are critically important. "Oh this bit I can change without anything bad happening". It shows there are unknown unknowns in security.
[ Parent | on HN ]
Re:LivingSocial Hacked – 50 Million Customers Affected by marshray on Monday April 29, 2013 @04:12PM (#5628383)
Well the Debian maintainer did realize this was important and emailed the OpenSSL developers. But due to a tragi-comedic miscommunication the breaking change got committed anyway.
[ Parent | on HN ]