Re: Obfuscating sensitive data? (was: response to tax software not encrypting tax info)

From: Dan Harkless (bugtraq@harkless.org)
Date: 03/14/03

  • Next message: flur: "Guestbook v1.1.3 CSS Vuln" 
    From: Dan Harkless <bugtraq@harkless.org>
To: bugtraq@securityfocus.com
Date: Fri, 14 Mar 2003 14:51:19 -0800

    Andreas Beck <becka@bedatec.de> writes:
    > 2) If 1) cannot be done for some reason, use _strong_ encryption to
    > _encrypt_ the data. XORing them with "wrdlbrmft" will just make an
    > attacker laugh, assuming he is just a bit smarter than a piece of wood.
    > Never just obfuscate the passwords by using a generic key. Even if
    > the app picks one individual key at installation time, it has to be
    > stored somewhere and when you can retrieve the file, chances are, that
    > you can as well retrieve the stored key.

    A more important argument against the application picking a random key at
    installation time is that if it gets lost (e.g. due to disk or registry
    corruption), the user's data is gone (which could have serious results in
    cases such as tax programs).

    Any secret required to decrypt the data should be supplied by the user so
    that they can take whatever steps are appropriate to make sure it doesn't
    get lost.

    > IMHIO obfuscating data serves only one purpose: Not giving away Information
    > to someone _briefly_ _viewing_ over the file. That's o.k. to keep the
    > sysadmin from the temptation to hit a user that picks a weak or offensive
    > password with a wet haddock. It's as well o.k. to guard a password against
    > a coworker that happened to look over your shoulder when you opened the
    > wrong file. But it is NOT o.k., if an attacker can retrieve the file and
    > play around with it all day.

    Obfuscation should never be encouraged over encryption, but obfuscation is
    certainly better than nothing (cleartext). Your comparison ignores the fact
    that the vast majority of people stumbling across someone's tax return on a
    file sharing network would have neither the inclination nor the ability to
    write or find software capable of de-obfuscation.

    Naturally true encryption is greatly desired just in case a true attacker
    _is_ out there, but obfuscation will certainly protect against that 99.x% of
    the population that _could_ download your tax return if they wanted to, but
    won't (or won't figure out how to get the obfuscated info out of it if they
    do). 

    --
Dan Harkless
bugtraq@harkless.org
http://harkless.org/dan/
  • Next message: flur: "Guestbook v1.1.3 CSS Vuln"

    Relevant Pages

    • Re: Running White-Box AES backwards
      ... Stanley Chow wrote: ... > Is this a secure obfuscation of K? ... Also note that the attacker could construct the decryption ... this scheme is not a secure obfuscation of the function x |--> ...
      (sci.crypt)
    • Re: Any benefit to file obfuscation?
      ... File obfuscation is not meant to be secure. ... My point remains, you have assumed your attackers are idiots, ... To see why this is a bad idea, take a look at the complexity ... Attacker complexity without change: 2^n +L ...
      (sci.crypt)
    • Re: White-Box Cryptography
      ... >> 2) The attacker might be able to learn something else about K by ... Barak call it an insecure obfuscation. ... protect, but not a difference between what you're looking for when protecting ...
      (sci.crypt)
    • Re: White-Box Cryptography
      ... it might be worth discussing the relationship to circuit ... Note that Barak et al. defines obfuscation in a much stronger way ... > advance if anyone were able to find a way to obfuscate AES like this. ... If we assume AES is secure, then the attacker ...
      (sci.crypt)
    • Re: Javascript Collection, Obfuscation, Crawling?
      ... current task is investigating javascript obfuscation techniques. ... You could use a browser to retrieve the pages as a crawler but the task of determining whether a page has script in it or not - across a very large number of pages - would best be left to some other program. ...
      (comp.lang.javascript)
    • Quantcast