Horrible public key tricks

118 points by rrampage

gerikson

For some reason, this post brings me great joy.

wofo

The linked pdf (No one can force me to have a secure website!!!) is hilarious and informative at the same time, thanks for sharing!

Kronopath

There’s also a video version of the paper.
- dsschnau
  
  it reminds me of this other "prior work" on https being a bit over-sold:
  
  Discourse on HTTPS | n-gate.com
  - Ambroisie
    
    To be honest, as a casual reader most of these retorts read like bad faith?
    
    gerikson
    
    That was the house style of n-gate.
  - jonatan
    
    There is no way that is not a shitpost.
    
    chrismorgan
    
    Mildly in its defence, it was 2017, and objection to HTTPS (on various grounds) was a little more common.
  - dsschnau
    
    I had to check to make sure, and sure enough, the cert for this site has a vanity message in it.
  - serce
    
    This reminds me of the fun ways people exploit error correction in QR codes to embed images and different shapes in them.
  - gir
    
    while the resulting public key would be week,
    
    Typo ;)
    
    I already read the pre-story on mastodon, nice to have a linkable version!
  - Zavec
    
    Outstanding work! I wonder if you can do that with any other cryptosystems. As far as my understanding of ECC goes it would be all but impossible there, but I know very little about the newer post-quantum ones. Maybe this is a good time to go read up on those.