News for hackers. Stuff that matters.
Re:Hack of Cupid Media dating website exposes 42 million pla... by sillysaurus2 on Wednesday November 20, 2013 @08:52AM (#6767929)
It's interesting that no one's pointed out that SRP is trivially breakable by having the client send zero as its "A" value.

Of course, you can guard against that particular case. But the point is that SRP has pitfalls, just like every other solution. And those pitfalls aren't well known; the Wikipedia pseudocode makes no mention of that exploit, for example.

Re:Hack of Cupid Media dating website exposes 42 million pla... by Jtsummers on Wednesday November 20, 2013 @09:23AM (#6768083)
Yes it does [1]. In the narrative example with Steve and Carol, it states 3 safeguards.

1. Carol will abort if she receives B == 0 (mod N) or u == 0.

2. Steve will abort if he receives A (mod N) == 0.

3. Carol must show her proof of K first. If Steve detects that Carol's proof is incorrect, he must abort without showing his own proof of K.

[1] Ok, the python code doesn't seem to, you're correct. However, that's less a demonstration of a protocol implementation, and more a demonstration of the protocol's math. The page does mention it though in the protocol section. It would be appropriate (and maybe later I'll do this) to break that out so it's more obvious.

Re:Hack of Cupid Media dating website exposes 42 million pla... by benjamincburns on Wednesday November 20, 2013 @09:52AM (#6768295)
"Up next on VH1's Where Are They Now?, Alice and Bob!"

    Alice: At the time I thought Eve was the only one I had to worry about. Little
    did I know, Carol would be the one who'd really replace me in the end.
Edit: Hmm, downvoted. I guess humor isn't welcome here?
Re:Hack of Cupid Media dating website exposes 42 million pla... by greyboy on Wednesday November 20, 2013 @12:12PM (#6769295)
Unfortunately, no.
Re:Hack of Cupid Media dating website exposes 42 million pla... by benjamincburns on Wednesday November 20, 2013 @01:19PM (#6769845)
A bit of transparency: Before the edit I received one downvote. After I received 5 upvotes, which is on the higher end of most of my comments. Either I reacted prematurely, or calling it out reversed the perception bias to the positive. I think it's some of both, as the joke really wasn't funny enough to warrant the score.