Posted by Jonas Elfström
Wed, 23 May 2007 05:12:00 GMT
Recently 2^1039-1 were factored. Is this the end of 1024 RSA encryption? Lenstra, one of the researchers, addresses this question: "Last time, it took nine years for us to generalize from a special to a non-special hard-to factor number (155 digits). I won't make predictions, but let's just say it might be a good idea to stay tuned."
2^1039-1 is a special number that the RSA algorithm would never use so 1024 RSA might still be secure for the time being but if you want to be future safe 2048 bits or more would be the way to go.
Posted in Security, Math | no comments
Posted by Jonas Elfström
Mon, 30 Apr 2007 10:54:00 GMT
Recently a friend of mine got problems while trying to book a hotel room online. The JavaScript-driven calendar was IE-only and he is on Mac OS X. My friend then checked the source and saw that the JavaScript actually just set a value to an hidden input field. He fired up Firebug and edited the field manually and then submitted the form. When he got the confirmation of the booking he saw that he accidently had typed 2006 instead of 2007. The only protection against booking at dates in the past, already fully booked or in the year 2100 were the JavaScript that ran the calendar.
When building a web application you can never ever trust that any of the data from the client will be untampered with.
Some problems I've seen in the past:
Relying on JavaScript-validation. JavaScript can be turned off or ran through a debugger.
Having sensitive data in hidden input fields.
Storing sensitive data in cookies.
- This is not a very common problem since almost all web application frameworks handles this for you by only storing a session id in the cookie and the actual data on the server.
Posted in Security | no comments | no trackbacks
Posted by Jonas Elfström
Fri, 30 Mar 2007 05:33:00 GMT
In an earlier post the example code did find prime numbers. Recently I stumbled over a really cool regexp hack that also deals with primes. This is how you execute that regexp in Ruby:
puts 'Prime' unless ('1' * 43) =~ /^1$|^(11+?)\1+$/
Change 43 to whatever you like and you will get Prime as output if it's a prime number.
EDIT: As you can see in the comments Neil Kandalonkar explained how the regexp by Abigail works.
Posted in Ruby, Math | 3 comments
Posted by Jonas Elfström
Fri, 30 Mar 2007 04:59:00 GMT
Now I've got a .com domain, you can reach this blog at http://alicebobandmallory.com/.
Posted in Blogging | no comments
Posted by Jonas Elfström
Tue, 27 Mar 2007 20:46:00 GMT
In an earlier post I mentioned that a security token that lets you sign your transactions is one way to go to get more secure Internet banking.
Now a couple of swedish students have shown (by also using the problem I mentioned in this post) that a security token both needs to be used in a secure manner and that it also needs to be simple for the user to know what he is actually signing. According to the press it seems that they did this as a man-in-the-middle attack. This is just speculations but it seems the reason that this were possible were that the user did not have a clear view of what he was signing.
It could have been done something like this:
- Redirect the user to a fake site (and hope that he does not
investigate the certificate).
- Ask for username and challenge the user with the verification code and then login to the bank in the background.
- Try to add a new account for transfers and then tell the user he mistyped and has to login again while challenging him to verify the new account.
- Transfer money the same way.
The bank has solved the problem by adding a 9 before all login codes. I'm not convinced this is simple and obvious enough for the users. One way to make it simple could be a security device with buttons labeled "login", "sign account" and "sign amount" or such.
EDIT: Now it has started to arrive phishing mails that asks the customers of Swedbank to install ssl3.exe...
Posted in Security | 2 comments | no trackbacks
