Gross and tiny security errors

Software

Andy LoPresto reposted this 2013 gem from Pinboard’s blog:

There is no difference, from the attacker’s point of view, between gross and tiny errors. Both of them are equally exploitable. In at least three [of the Matasano Crypto Challenges], the mere fact of getting distinguishable error messages was enough to recover the entire message.

This lesson is very hard to internalize. In the real world, if you build a bookshelf and forget to tighten one of the screws all the way, it does not burn down your house.

Author bio and support

Me!

Ruben Schade is a technical writer and IaaS engineer in Sydney, Australia who refers to himself in the third person in bios. Wait, not BIOS… my brain should be EFI by now.

The site is powered by Hugo, FreeBSD, and OpenZFS on OrionVM, everyone’s favourite cloud infrastructure provider.

If you found this post helpful or entertaining, you can shout me a coffee or buy some silly merch. Thanks!