Birbla

Join the discussion

Write your take first — we'll ask for email only when you're ready to publish.

Sign in
  • Hacker News
  • It still leaks when you turn bluetooth off in "control center". Last time i checked you're broadcasting an unchanging uuid that only changes every 12 hours or so. It's gross.
    by pcdoodle
  • A side channel attack revealing AES key from just 90,000 traces.

    Sigh, side channel attacks seem to be everywhere now.

    by vardump
  • people are finally aware everything leaks, it's just a matter of how closely you look
    by sitzkrieg
  • That 90,000 traces did take 225 hours to capture so it is truly a huge amount of data and not a trivial attack.
    by barbegal
  • I read the abstract, while not familiar with the topic, how would we go about limiting the inpact?
    by 3abiton
  • Rotating keys frequently would probably help. But the best thing to do is use implementations that are less leaky in the first place (which is easier said than done).
    by Retr0id
  • Time for everyone to implement some variation of https://www.bluetooth.com/specifications/specs/authorization... ?
    by Verdex
  • I really think we need a modern replacement to bluetooth, something that doesn't have weird behaviour with headphones, is more secure and doesn't have weird connection issues all the time, and is as ubiquitous as bluetooth is now. I know it will never happen, but I can only hope
    by voidUpdate
  • Yes please, immediately.

    It's been so terribly bad since it came out. You know it's bad when there's even an xkcd about it: this one is from 5 years ago, joking about 10 years before that. https://xkcd.com/2055/

    by imglorp
  • Well what's interesting to me is that Logitech has their wireless dongle and wireless gaming headphones (which need lower latency) have theirs. These have existed for how many decades? Surely there's a way to just standardize this. And it shouldn't need to be long range. Just a few meters to the tv or something.
    by Neywiny
  • I guess that's where Bluetooth LE and LE Audio should come in, but it's coming along very slowly or not at all in Apples case. Or maybe it is, they don't talk about it
    by zwirbl
  • As someone who finally recently escaped bluetooth firmware development: yes, Bluetooth is leaking secrets and it doesn't even require any silly RF shenanigans. Almost nothing actually implements LESC. Apple refuses to implement OOB pairing, so no peripherals can force you to use it, so everything is subject to MITM attacks. The entire ecosystem is a mess of consultants and underpaid devs copy-pasting Nordic sample code, with no time or financial incentive to do more than the bare minumum. Never trust any product that moves sensitive data through Bluetooth.
    by ryukoposting
  • Just curious if it that insecure how does Magic Keyboard with Touch ID works? Does it use some apple proprietary "magic"?
    by SXX
  • Apple claims to have implemented an entire second security level for their Bluetooth apps based on iMessage, but I trust it not at all.

    (To be clear, I trust the iMessage protocol with reasonable confidence. I judge the probability that Apple has applied this extra layer of security uniformly to all sensitive data to be about 8%.)

    by matthewdgreen
  • Do you have an opinion on the keyboard firmware ZMK? They seem to use LESC but MITM during pairing is still a concern: https://zmk.dev/docs/features/bluetooth
    by 9029