• 0 Posts
  • 24 Comments
Joined 1 year ago
cake
Cake day: June 26th, 2023

help-circle
  • It seems OP wanted to pass the file name to -k, but this parameter takes the password itself and not a filename:

           -k password
               The password to derive the key from. This is for compatibility with previous versions of OpenSSL. Superseded by the -pass argument.
    

    So, as I understand, the password would be not the first line of /etc/ssl/private/etcBackup.key, but the string /etc/ssl/private/etcBackup.key itself. It seems that -kfile /etc/ssl/private/etcBackup.key or -pass file:/etc/ssl/private/etcBackup.key is what OP wanted to use.



  • That command will produce a list of (dynamic) libraries that are being used by that helper. It will look somewhat like this (this is copied from my Arch instalation):

    	linux-vdso.so.1 (0x00007edb2f060000)
    	libcurl.so.4 => /usr/lib/libcurl.so.4 (0x00007edb2ee6f000)
    	libpcre2-8.so.0 => /usr/lib/libpcre2-8.so.0 (0x00007edb2edd1000)
    	libz.so.1 => /usr/lib/libz.so.1 (0x00007edb2edb8000)
    	libc.so.6 => /usr/lib/libc.so.6 (0x00007edb2ebcc000)
    	libnghttp3.so.9 => /usr/lib/libnghttp3.so.9 (0x00007edb2eba9000)
    	libnghttp2.so.14 => /usr/lib/libnghttp2.so.14 (0x00007edb2eb7f000)
    	libidn2.so.0 => /usr/lib/libidn2.so.0 (0x00007edb2eb5b000)
    	libssh2.so.1 => /usr/lib/libssh2.so.1 (0x00007edb2eb12000)
    	libpsl.so.5 => /usr/lib/libpsl.so.5 (0x00007edb2eafe000)
    	libssl.so.3 => /usr/lib/libssl.so.3 (0x00007edb2ea24000)
    	libcrypto.so.3 => /usr/lib/libcrypto.so.3 (0x00007edb2e400000)
    	libgssapi_krb5.so.2 => /usr/lib/libgssapi_krb5.so.2 (0x00007edb2e9d0000)
    	libzstd.so.1 => /usr/lib/libzstd.so.1 (0x00007edb2e8ef000)
    	libbrotlidec.so.1 => /usr/lib/libbrotlidec.so.1 (0x00007edb2e8e0000)
    	/lib64/ld-linux-x86-64.so.2 => /usr/lib64/ld-linux-x86-64.so.2 (0x00007edb2f062000)
    	libunistring.so.5 => /usr/lib/libunistring.so.5 (0x00007edb2e250000)
    	libkrb5.so.3 => /usr/lib/libkrb5.so.3 (0x00007edb2e178000)
    	libk5crypto.so.3 => /usr/lib/libk5crypto.so.3 (0x00007edb2e14a000)
    	libcom_err.so.2 => /usr/lib/libcom_err.so.2 (0x00007edb2e8d8000)
    	libkrb5support.so.0 => /usr/lib/libkrb5support.so.0 (0x00007edb2e13c000)
    	libkeyutils.so.1 => /usr/lib/libkeyutils.so.1 (0x00007edb2e8d1000)
    	libresolv.so.2 => /usr/lib/libresolv.so.2 (0x00007edb2e12a000)
    	libbrotlicommon.so.1 => /usr/lib/libbrotlicommon.so.1 (0x00007edb2e107000)
    

    It might be a good idea actually to try running this both when it works and when it doesn’t, maybe there is some difference?







  • metiulekm@sh.itjust.workstoProgramming@programming.dev...
    link
    fedilink
    English
    arrow-up
    3
    arrow-down
    1
    ·
    4 months ago

    I really need to try out Mercury one day. When we did a project in Prolog at uni, it felt cool, but also incredibly dynamic in a bad way. There were a few times when we misspelled some clause, which normally would be an error, but in our case it just meant falsehood. We then spent waaay to much time searching for these. I can’t help but think that Mercury would be as fun as Prolog, but less annoying.

    I actually use from time to time the Bower email client, which is written in Mercury.


  • My understanding is that all issues are patched in the mentioned releases, the config flag is not needed for that.

    The config flag has been added because supporting clients with different endianness is undertested and most people will never use it. So if it is going to generate vulnerabilities, it makes sense to be able to disable it easily, and to disable it by default on next major release. Indeed XWayland had it disabled by default already, so only the fourth issue (ProcRenderAddGlyphs) is relevant there if that default is not changed.



  • I’m betting there’s probably something that generates the key from a vastly smaller player input, i.e what gameobjects you interacted with, in what order, or what did you press/place somwhere. But that also means that the entropy is probably in the bruteforcable range, and once you find the function that decrypts the secrets, it should be pretty easy to find the function that generates the key, and the inputs it takes.

    When handling passwords, it is standard practice to use an intentionally costly (in CPU, memory, or both) algorithm to derive the encryption key from the password. Maybe the dev can reuse this? The resulting delay could easily be masked with some animation.







  • I am no cryptographer, but I understand that in the SSH protocol, the keys are only used for signing anyway: that is, the user is authenticated by saying “I want to authenticate with some key, and here’s some data signed by this key”, and this is completely separate to encryption. It also seems that GitHub encourages using separate keys for commit signing and general SSH access, which might alleviate some of the ickyness.

    You are really not wrong though, I feel like people only started using SSH for this because it kinda worked and they already have been familiar with it.



  • You could make an argument that not using banking apps decreases your security, since most banks use either SMS or those apps as the second factor while confirming the operations. It is true that the apps are of varying quality, but SMS is not really a serious alternative. Some banks do have apps that are limited to confirming operations, and one bank where I live did recently start accepting U2F, which is amazing news.