Slashdot Mirror
Schneier et al Report PGP Vulnerability
SpaceTaxi writes: "Researchers reported that they were able to intercept and modify a PGP encrypted message so that, IF it is sent back to the attacker, the original message could be read by the attacker." The paper comes from Kahil Jallad, Jonathan Katz, and Bruce Schneier. Here is the Yahoo! article.
leaving the door open for instances like this.
PEBKAC conquers all, as usual.
Cretin - a powerful and flexible CD reencoder
... he hasn't posted an article since Jul 15th!
Is he still employed with OSDN??
Inquiring minds want to know!
Good quote, too many chars. Seriously, the slashdot 120 char limit sucks!
ENCRYPTED.TXT ...but it is corrupt. Could you please send me a copy?
Here is my public PGP key:
It's not even based on the Navajo language! No wonder it's vulnerable!!!
First the SSL bug, now this? Looks like we have to go back to two paper cups and a piece of string for sending encrypted messages to each other...
Aw, fuck it. Let's go bowling. - The Big Lebowski
Every day it seems like there is some new vulnerability discovered in one of our beloved secure communication tools/protocols (PGP, SSL, SSH, etc). This really hurts me a lot, as I feel my trust has been shattered.
For this reason, I ask... no beg... all hackers, researchers, programmers, etc to please stop reporting these security problems. Find something? Keep it quiet! Don't tell anyone, and then no one will know, and we'll all still be safe. Maybe in a few years, you can quietly patch it up, and we'll all go on like nothing has happened. Sound good?
Let's all follow Microsoft's lead on this one. Thanks guys!
I use alcohol to encrypt my email messages to specific people, people like ex-gfs, college professors, old bosses, etc. Example: Ihate tyou. WHY doaNt you JSust dddieee!@#! My MMMOOOM tlds mee yYoyu wass BadDS KNwesss. True its not the as secure as PGP but it has it's uses.
Errata from the desk of Bruce Schneier: Pay no attention to p. 584-587 of Applied Cryptography - 2nd Edition... I didn't know what I was talking about... now I do.
come on fhqwhgads
Was the inclusiion of Jon Katz in the study.
I assume they used all his civil rights encrypted emails from his excellent Hellmouth series to demonstrate the exploit.
I would be surprised if he actually had time to study anything between his pandering to children, and RPG'ing to understand the socio-economic realities of the real world.
he must be really multi-talented.
Sorta' Good Privacy.