• 0 Posts
  • 58 Comments
Joined 3 years ago
cake
Cake day: June 10th, 2023

help-circle
  • BW06: Icon URL Item Decryption. Items can include a URL field, which is used to autofill the credentials and display an icon on the client. The client decrypts the URL and fetches the icon from the server, including in its request the domain and top-level domain of the URL. For instance, if the URL is “https://host.tld/path”, the client request includes “host.tld”. This means that the adversary can learn (part of) the con- tents of URL fields. Using Attack BW05, an adversary can place the ciphertext of sensitive item fields, such as a user- name or a password, in the encrypted URL field. After fetch- ing the item, the client will then decrypt the ciphertext, confus- ing it for a URL. If the plaintext satisfies some conditions (i.e. containing a ‘.’ and no !), it will be leaked to the adversary. A URL checksum feature was deployed in July 2024, mak- ing the clients store a hash of the URL in another encrypted item field, therefore providing a rudimentary integrity check and preventing this attack. Note that old items are never up- dated to add such a checksum: this feature only protects items created after its introduction. Furthermore, URL checksums are only checked if a per-item key is present for the item. As we will see, an adversary can prevent per-item keys from being enabled with Attack BW10.

    IMPACT. The adversary can recover selected target ciphertexts in the item, such as the username or the password.

    REQUIREMENTS. The user opens a vault containing items that do not use per-item keys (i.e., items created before July 2024, or after Attack BW10 is run). The target plaintext must satisfy some additional conditions, detailed in Appendix

    from the paper the article is discussing

    So you could potentially expose your passwords to a compromised server or some kind of MITM. If they meet the conditions for the validation check, anyway.










  • Replying isn’t disengagement. I used the knife as an example because it makes it clear that putting someone in immediate danger with no concern for their safety is a kind of “intent”. If I juggled the knives near you instead would the humorous contrast make the analogy more palatable? Im just an amateur knife juggler, playing with his knives in your personal space after we had an argument, no hostile intent here.




  • If you have a better way to explain their motivations and reasoning I’m all ears. I’m sharing my view in hopes to refine it when presented with counter arguments, in an effort to help both of us reach a more accurate understanding of the situation we are in. If we hope to prevent their plans we must understand what they’re thinking, and discussing their behaviors seems to be more useful for doing so than trying to reconcile some kind of coherence between their actions and statements.

    The horse is also sensitive about it’s incontinence, please just try to pretend he’s not here.


  • Anyone who hasn’t “picked a side” yet has had more than enough examples of hypocrisy to convince them if that were something that mattered to them. The fence sitters who remain aren’t interested in examining the validity of the MAGA movements “reasoned arguments”. They are vibes based morons who are more influenced by their feelings and peer pressure and they probably aren’t on Lemmy.

    Do what you want man, just leave my horse and his height out of it; he’s very sensitive about it.


  • There’s a point to itemizing their crimes and stating them publicly.

    Pointing out hypocrisy is about trying to make someone understand a flaw in their reasoning. There is no flaw in their reasoning because they did not use reason to reach their conclusions.

    Edit: It’s like pointing at someone in the midst of a schizophrenic delusion and saying “woah can you believe this guy?! He thinks the CIA is gonna crawl out of the sewer and carry him off to the KGB headquarters in Obamas secret underground lair! Doesn’t he know that’s stupid and makes no sense!?” You’re criticizing madness as if it were a legitimate reasoned argument.





  • underisk@lemmy.mltoPolitical Memes@lemmy.worldReal Nazis
    link
    fedilink
    arrow-up
    13
    arrow-down
    3
    ·
    7 days ago

    That’s not an excuse to refuse to vote against full-blown fascism, but there needs to be a reckoning against neoliberalism and capitalism in general before anything will change.

    Why would they stop putting up neolib candidates if you’ll vote for them regardless?