[39732] in Cypherpunks
Re: Netscape is doing well -- give 'em a break.
daemon@ATHENA.MIT.EDU (Nelson Minar)
Thu Sep 21 02:33:38 1995
Date: Thu, 21 Sep 95 00:31:12 MDT
From: nelson@santafe.edu (Nelson Minar)
To: cypherpunks@toad.com
In-Reply-To: <9509210552.AA07852@toad.com>
>Netscape is to be commended for even *putting* crypto into their product!
I'm impressed with the way Netscape has responded to recent
events. It's refreshing to see a company say "yes, we made a mistake
in our security software" rather than pretend there's no problem.
Word Perfect encryption, anyone?
>Cygnus' Kerberos faced the same random-seed problems and punted in
>similar ways.
Last time I looked, the MIT-MAGIC-COOKIE-1 scheme used in X11R4 had
the same problem: the random seed was based on the current time to the
microsecond, modulo the granularity of the system clock. I think I
figured that on my hardware, if I could figure out which minute the X
server started (easy with finger), I'd only have to try a few
thousand keys or so. Caveat: I never actually proved the idea.
