Birbla

Join the discussion

Write your take first — we'll ask for email only when you're ready to publish.

Sign in
  • Hacker News
  • > While I haven’t verified this LLM output is entirely trustworthy, it looks pretty plausible.

    It's essential that you do, because generating pretty plausible outputs is an LLM's bread and butter. Otherwise, only the one that you actually tested should be expected to be correct.

    by mitxela
  • > I don’t have any good reason to do that, but it seems like fun.

    What better reason is there to do something than it being fun?

    by teiferer
  • That SSL report with four different automatic 'F's is an amazing punchline
    by pvillano
  • I am not a cryptography expert but I am interested in the field. Having said that: I am lately having an hard time understanding the actual strength of a crypto suite based on the underlying problem, the sized of the material and the computation strength needed to break it either via optimization and parallelism capabilities.

    > The Web PKI deprecated 1024-bit RSA over a decade ago, and while I don’t know of anyone factoring a key of that size, it’s within the realm of possibility for a government or other organization with a large number of computers.

    Is it? How do I verify such claim?

    ---

    > Just a few days ago, someone factored the 862-bit RSA-260 key from the RSA factoring challenge.

    Yeah, but how much time it required? and what about the resources? It is just a number, it is not all the 861 bits n numbers.

    by GracefullyShot
  • I owned the "broker FTP" service at a hedge fund.

    There was a project in 2021 to talk to the banks and brokers that we connected and ask them to upgrade their keys and ciphers to modern versions.

    IIRC, the oldest key/cipher was from the late 2000s so it wouldn't surprise me if someone is using RSA keys from the 90s somewhere.

    You can read more about how hedge funds use FTP here: https://x.com/alexpotato/status/1809579426687983657?s=20

    Or listen to patio11 and I talk about these systems in general here: https://www.complexsystemspodcast.com/episodes/two-banks-can...

    by alexpotato
  • Basically 2 days on a consumer GPU to crack a 512 bit cert. The thing is much of the traffic back then did not use ephemeral keys. Most of it wasn't even encrypted at all! But about a decade later, it became normal to encrypt everything. I do wonder which governments around the world are just waiting to crack anonymous political speech by recording and saving for later when decryption can happen.
    by goalieca
  • A bit unfortunate that so many of the interesting bits were left to ai. I would've enjoyed some commentary on why the custom TLS implementation was necessary. Oh well.

    Update: found this explanation in a comment at the top of the (surprisingly short) Go file in the linked repo:

    The target client is Netscape Communicator 4.51 (both the 40-bit export build and the 128-bit US build) with its clock set to the year 2000.

    Go's crypto/tls cannot help: it dropped SSLv3 in Go 1.14, never accepted the SSLv2-compatible ClientHello that Netscape 4 sends, and never had RC4-MD5 or the 40-bit export suites. So this file carries its own tiny SSLv3 server-side implementation on top of stdlib primitives (RSA PKCS#1 v1.5, RC4, DES, 3DES, MD5, SHA-1). The server key is 512-bit RSA so that export clients can encrypt the premaster secret to it directly, without a ServerKeyExchange.

    by 63
  • I was the product manager with responsibility for root certificates in the Netscape 4.51 browser. It's crazy to see someone factor it 25 years later.

    Just to reply to some people in the comments. Yes, we knew export grade encryption was weak - that was the point - that the NSA could decrypt it - and the govt. required us to do it anyway.

    FWIW - we had the goal of expanding the list of root authorities in the 4.5x release - and this might have been the first release to monetize the root slots because Netscape was under severe pressure to generate revenue.

    (Also - Verisign hated that we were expanding competition and tried to convince us to implement a program that would re-restrict the list to a set of "responsible" companies aka Verisign and one or two others. We declined.)

    by hnmullany

Explore Birbla archives