

I didn’t think you were making the post to defend Bitwarden or something. I was just adding the details of one of the exploits the paper found that directly contradicted their claim.


I didn’t think you were making the post to defend Bitwarden or something. I was just adding the details of one of the exploits the paper found that directly contradicted their claim.


BW06: Icon URL Item Decryption. Items can include a URL field, which is used to autofill the credentials and display an icon on the client. The client decrypts the URL and fetches the icon from the server, including in its request the domain and top-level domain of the URL. For instance, if the URL is “https://host.tld/path”, the client request includes “host.tld”. This means that the adversary can learn (part of) the con- tents of URL fields. Using Attack BW05, an adversary can place the ciphertext of sensitive item fields, such as a user- name or a password, in the encrypted URL field. After fetch- ing the item, the client will then decrypt the ciphertext, confus- ing it for a URL. If the plaintext satisfies some conditions (i.e. containing a ‘.’ and no !), it will be leaked to the adversary. A URL checksum feature was deployed in July 2024, mak- ing the clients store a hash of the URL in another encrypted item field, therefore providing a rudimentary integrity check and preventing this attack. Note that old items are never up- dated to add such a checksum: this feature only protects items created after its introduction. Furthermore, URL checksums are only checked if a per-item key is present for the item. As we will see, an adversary can prevent per-item keys from being enabled with Attack BW10.
IMPACT. The adversary can recover selected target ciphertexts in the item, such as the username or the password.
REQUIREMENTS. The user opens a vault containing items that do not use per-item keys (i.e., items created before July 2024, or after Attack BW10 is run). The target plaintext must satisfy some additional conditions, detailed in Appendix
– from the paper the article is discussing
So you could potentially expose your passwords to a compromised server or some kind of MITM. If they meet the conditions for the validation check, anyway.
I thought the stripes were actually camouflage and they’re just monochromatic because the things they’re hiding from have poor color vision.


Letting them win because you’ve conceded before even playing is also a losing formula. Even if they don’t get awarded monetary damages they can probably at least get their legal expenses covered.


Libel. Taking it down doesn’t undo the damage to reputation which libel is concerned with. They might not get any monetary damages awarded but could maybe force Ars to put out a retraction.


South African-born
Hmmm


Replying isn’t disengagement. I used the knife as an example because it makes it clear that putting someone in immediate danger with no concern for their safety is a kind of “intent”. If I juggled the knives near you instead would the humorous contrast make the analogy more palatable? Im just an amateur knife juggler, playing with his knives in your personal space after we had an argument, no hostile intent here.


Does the jury use it’s psychic empathy to determine what was in my heart at the time the knife perforated your larynx or do they use the circumstances leading up to the murder to determine if I had intent to kill you or not?


If I bring out a knife and kill you with it but only because I tripped while holding it at your throat, did I intend to kill you or not? Does it matter?


deleted by creator
Worked out for AJJ, kinda.


“So they just sit here and eventually someone brings them food?”
It could always turn out like NFTs did. Don’t lose hope yet.


Sure, but I think wanting to fuck children does kind of paint a vivid picture about your general moral character in a way your dietary preferences might not.
More like fae horror, imo.


Great; a return to thin clients. How innovative and revolutionary.
Officer you said the culprits were wearing bandit masks? Well, surely you agree it would be absurd for us to wear such a mask!
and if you do that you must turn the wheel on its side and see the tower that is ‘I’ or you will zero sum and cease to exist.
Pretty on the nose that the Israeli spyware company named their spyware after what we call people who sexually assault children.