Hacker News new | past | comments | ask | show | jobs | submit login

Security expert love to discuss ciphers but how commonly old ciphers are exploited by threat actors in real world?

I heard cryptographic weakness are sometimes used to break tivoization/DRM but I don't consider people who do this threat actors - an owner should be free to run any software on own hardware. And an attack on device you hold in hands is completely different than say an attack on remote FreeBSD server.




I'm one of those security experts. I've broken more cryptosystems than I can count through security & code reviews. You would be surprised how many vendors have no idea on how cryptographic primitives work or when/how to use it. This is exactly what we mean when we say "don't roll your own crypto".

There is a communications problem within all of this. If I break a cryptosystem, I do not have permission by either party (customer/employer) to go and write a blog post about it. All in the name of "protecting our users". The same goes for my colleagues around the world, as such it gets very little attention.

As for threat actors misusing it, there is a value/effort calculation in their world where it is often easier to access content through other means. Crypto is hard - for everyone, even threat actors - so you won't often see them trying to tackle it.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: