craigphicks

8 jaar geledendiscuss

According to the Atlantic, Kolodny's thesis is that toolbuilding laid the groundwork for the development of language. How about other human behaviors such as group activities requiring coordination and planning, or language as a means to invoke and control specific emotions in others? Certainly activities such as building encampments, changing encampments, delegation of tasks, coordination during hunting and gathering, all these also required sequenced actions. Fast forward to the present, and toolmakers are generally below the topmost pinnacle of society; MIT's endowment is only 13 billion compared to Harvard's 35 billion (humor intended). Dogs and chimps seem to enjoy hearing, learning, being influenced, and being told what to do via language, yet aren't capable of speaking it. Surely pre-modern humans were the same, leaving open a huge selective advantage for the development of vocal/language skills.

craigphicks

8 jaar geledendiscuss

The EFAIL is particularly effective because it can surround every whole encrypted block B with chosen encrypted binary to yield ABC which decrypts to

    "...<img src="...[plaintext of b]...">.

Yet it also has the limitation that it cannot further divide the encrypted block B. Also, EFAIL depends upon plaintext of B being part of and HTML attribute value. Attribute values have a choice of only three final delimiters: doublequote (") singlequote (') and space ( ). So if every plaintext that is encrypted as a single block is prefaced by those three characters, then EFAIL cannot what comes after those characters. (Call it an obfuscation string). Play round with this sandbox

    https://try.jsoup.org/%7E_nyXks5PuAs-zJeek8CVhpuAvtI

to see how that works.

I've written in more detail at

    A Solution for Sending Messages Safely from EFAIL-safe Senders to EFAIL-unsafe Receivers
    https://github.com/craigphicks/efail-safe-send-to-insec-recv/wiki

The thing about new EFAIL reading-safe versions that somehow force or Strongly! advise to use MDC is that some readers won't update for years. And that becomes the problem of the sender when their messages are exfiltrated. Only if the message format is changed so that old readers can't read new messages ... but there are obvious drawbacks to that.

That's why I think this sender-safe solution, even if its a bit ugly, is worth considering.

Any implementation would have to be close to the encryption module, to avoid any mistakes aligning the obfuscation string with the encryption boundary start, actively checking that alignment is correct.

comments