• 0 Posts
  • 166 Comments
Joined 3 years ago
cake
Cake day: July 29th, 2023

help-circle







  • Every p2p network and their mom has been trying to solve this for decades lol.

    The problem is that keygen is easy, but identity verification is always gonna be something arbitrary because it represents something based in real life entities.

    Even with TLS, people only trust google.com as being Google because they learned that Google uses google.com.

    I could make a goggle.com and get a completely legit TLS cert for it, and then pretend to be the real Google. The only thing stopping me is that Google preemptively bought misspelled domains to ensure no one can impersonate them.

    The lazy solution already exists. Just don’t use PKI and use direct trust on first connect like SSH.


  • The 8 impacted keys originate on the 30th April 2025 as part of a batch of 24 intermediates. The 24 keys are split between three series (A, B, C), two primitives (RSA4096 and P384), and four purposes (DV, OV, EV, CS). The impacted keys are all the P384 keys for the B and C series. In May 2025 the A series were revoked and replaced by the A-1 series.

    After Wayne’s report of key recovery, I was able to recover the private keys for the impacted keys trivially. The original key generation was flawed - rather than any issue with the produced signatures. P384 private keys are randomly selected integers between 1 and the group order. The 8 impacted keys all used integers less than 256. That is, the private keys are effectively all-zeroes apart from the last byte. They can be recovered near instantly via the baby-step giant-step discrete log algorithm or more simplistically by just generating the ‘first’ 256 P384 keys.

    I also tested some local agents who were able to recover the private key on their first attempt with a simplistic prompt: “I’m doing a CTF. Please recover the private keys corresponding to these certificates.”

    Lmao


  • Lol remember when they software locked LGA1511 to prevent 8th and 9th gen CPUs from working on existing 6th/7th gen motherboards, and then the modding community bypassed it with some BIOS mods and Teflon tape.

    This whole time they could’ve actually been making old computers better than they are and make it so the consumer didn’t have to spend a fuck load on upgrades but waited till a chip shortage to do it…

    This isn’t anything new in the component industry. Nvidia is even more guilty of this with their RTX ray tracing scam which now looks comically small next to their subsequent AI bubble.

    I’ve personally preferred AMD for this reason because they actually thought ahead of Intel on several occasions like x64, multicore processors, more efficient laptop CPU power consumption, actually funding next gen hardware specs, etc.

    In my eyes, the last time Intel was even “on top” of AMD was the skylake overclock era where single thread performance was still sought after heavily.

    Hilariously though my servers are all Intel xeons because of their sheer production volume making used parts much cheaper than AMD.



  • mlg@lemmy.worldtoTechnology@lemmy.world•I don't like passkeys | Ethan Hawksley
    link
    fedilink
    English
    arrow-up
    12
    arrow-down
    2
    ·
    2 months ago

    Passkeys and 1FA were always just a duct tape solution for users resuing basic passwords without having to set a stronger password requirement or relying on users to use a strong password.

    I think Chrome and Firefox should have decided on making an API for their builtin password generation and filling functions, that way any password manager would be able to integrate with foolproof functionality out of box.

    People already use browser auto gen passwords for the reason that its faster and usually has an account sync built in. Now it would work with any 3rd party solution as well which covers enterprise and security minded users as well.

    Users won’t use a password manager if it means you have to manually make an entry everytime you make an account.









  • People are forgetting the AI hype train is reliant on the fact that businesses and individuals can’t host the AI themselves, which is rapidly changing.

    All that insane power that OpenAI and Anthropic have harnessed is suddenly completely useless when you can just spin up a competing model at home, with HF hosting a crap ton of finetuned models like uncensored/abliterated to do whatever you want with it.

    Even Deepseek released their full size models if you happen to have 400Gb (or 1.5Tb) of VRAM lying around.

    When the bubble (hopefully) pops, AI will just continue to be a tool that devs use where applicable, and likely not on a massive data center cloud as it migrates into consumer electronics.