🚀 go-pugleaf

On Mar 21, 6:16 am, Urbin <ur...@invalid.invalid> wrote:
> On Mon, 21 Mar 2011 09:45:46 GMT, Ashen Shugar wrote:
> >  I think it was Urbin <ur...@invalid.invalid> that wrote something
> >  like...
>
> > >On Sat, 19 Mar 2011 21:09:06 +0000, Catriona R wrote:
>
> > >>  On Sat, 19 Mar 2011 21:03:26 +0000 (UTC), ScratchMonkey
> > >> <ScratchMonk...@sewingwitch.com> wrote:
>
> > >> >http://threatpost.com/en_us/blogs/rsa-warns-customers-targeted-attacks-
> > >> >wake-hack-031811
>
> > >>  Guess not:
>
> > >>  "The Blizzard Authenticators are based off modified Vasco tokens. I'm
> > >>  sorry to hear about RSA's troubles, but it will not affect the
> > >>  Blizzard Authenticator."
>
> > >>  http://blue.mmo-champion.com/topic/164619/rsa-compromise-concerns-abo...
>
> > >Hm, famous last words or justified consolation?
>
> >  Well, it sounds like the Blizzard authenticators use a somewhat
> >  different algorithm to the RSA ones, so nothing about the RSA stuff
> >  would give a direct method to hacking Blizzard authenticators.  The
> >  only possible problem that I could see would be if the RSA stuff isn't
> >  actually properly designed.  A properly designed encryption method is
> >  secure even if people know exactly how it works.  If however, the RSA
> >  stuff *isn'* properly designed and the Blizzard authenticators use a
> >  similarly improper design, then knowing how the RSA stuff is weak
> >  could show someone how the Blizzard authenticators are probably weak
> >  and thus how to "hack" them.
>
> >  RSA's comments suggest that their design is probably designed properly
> >  and their suggestions to be careful are just ones that everyone should
> >  be doing anyway all the time to avoid man in the middle attacks that
> >  circumvent the protection from having an authenticator.
>
> Oh, I agree with your conclusion. It was more the wording of the blue poster
> that prompte my post. The "but it will not affect the X" sounds a lot like
> "but there is nothing to worry about" often heard in disaster scenarios
> before people grasp the full potential of what occurred.
>
> Cheers
> Urbin

I used to work at RSA - in fact, I created a number the software token
implementations for PDAs and cellphones.

The algorithms used have had a lot of review, both internal and
external, but are not made public for business competition reasons.
The security of the system doesn't rely on keeping the algorithms
secret. The recent attack, while embarrassing, isnt really
significant.

pt