Tavis Ormandy

>unoptimized memcpy

could anyone do any better on 68000? My incomplete history of CPU dedicated fast paths for moving data:

- 1982 Intel 186/286 'rep movsw' at theoretical 2 cycles per byte (I think its closer to 4 in practice). Brilliant, then intel drops the ball for 20 years :|

- 1986 WDC W65C816 Move Memory Negative (MVN), Move Memory Positive (MVP) at hilarious 7 cycles per byte. Slower than unrolled code, 2x slower than unrolled code using 0 page. Afaik no loop buffer meant its re-fetching whole instruction every loop.

- 1987 NEC TurboGrafx-16/PC Engine 6502 clone by HudsonSoft HuC6280 Transfer Alternate Increment (TAI), Transfer Increment Alternate (TIA), Transfer Decrement Decrement (TDD), Transfer Increment Increment (TII) at hysterical 6 cycles per byte plus 17 cycles startup. (17 + 6x) = ~160KB/s at 7.16 MHz CPU. For comparison IBM XT with 4.77 MHz NEC V20 does >300KB/s

- 1993 Pentium 'rep movsd' at theoretical 4 bytes per cycle, 0.31 cycles per byte in practice http://www.pennelynn.com/Documents/CUJ/HTML/14.12/DURHAM1/DURHAM.HTM

- 1995 Pentium Pro "fast string mode" strongly hinted at REP MOVS as the optimal way to copy memory.

- 1997 Pentium MMX 'rep movsd' 0.27 cycles per byte. Mem copy with MMX registers 0.29 cycles per byte.

- 2000 SSE2 optimized copy hack.

- 2008 AVX optimized copy hack at ~full L2/memory bus speed for large enough transfers.

- 2012 Ivy Bridge Enhanced REP MOVSB (ERMSB), but funnily still slower than even the SSE2 variants.

- 2019…

The funniest part about WordPress is that you can usually achieve at least a 50% speed boost or more by adding a plugin that just minifies and caches the ridiculous number of dynamic CSS and JS files that most themes and plugins add to every page. Set those up with HTTP 103 Early Hints preload headers (so the browser can start sending subresource requests in the background before the HTML is even sent out, exactly the kind of thing HTTP/2 and /3 were designed to make possible) and then throw Cloudflare or another decent CDN on top, and you're suddenly getting TTFBs much closer to a more "modern" stack.

The bizarre thing is that pretty much no CMS, even the "new" ones, seems to automate all of that by default. None of those steps are that difficult to implement, and provide a serious speed boost to everything from WordPress to MediaWiki in my experience, and yet the only service that seems to get close to offering it is Cloudflare.

Even then, Cloudflare's tooling only works its best if you're already emitting minified and compressed files and custom written preload headers on the origin side, since the hit on decompressing all the origin traffic to make those adjustments and analyses is way worse for performance than just forwarding your compressed responses directly, hence why they removed Auto Minify[1] and encourage sending pre-compressed Brotli level 11 responses from the origin[2] so people on recent browsers get pass-through compression without extra cycles being…

> For the majority of people, storing TOTP in 1Password is well within their risk tolerance. There will always be those of you who will trade that convenience because you want or require the added protection of true 2FA. And to those faithful hardware key crew members: Think of your true second factor as less “extra layer of security,” and more granular protection that will apply only if you’re subject to certain forms of attack.

this is the crux really. Especially when a web based password manager is in use [0], this is not at all within risk tolerance for people really striving for a long-term threat model which they do not need to revisit every couple of years.

Buying multiple hardware tokens and keeping one authenticator/TOTP app on phone is very practical the best you can do and it is secure, loss-proof and will last for a long time. Most services allow you to add multiple types of 2FA devices.

0. https://lock.cmpxchg8b.com/passmgrs.html

It's definitely a neat demonstration that he can produce a collision for these favourable "neutral-bit" IV's relatively cheaply.

I suppose the next steps are to find two inputs that produce favourable IV's, then repeat this process for those, and that seems like it's getting really close. Stevens actually already has the best near-collision in non-reduced SHA-1 I know about from this paper:

http://marc-stevens.nl/research/papers/EC13-S.pdf

I made a quick visualization of it here, it looks pretty cool:

https://lock.cmpxchg8b.com/shatter/visualize.html?stevens=1

I also added the Shappening vectors:

https://lock.cmpxchg8b.com/shatter/visualize.html?shappening=1

It's funny that they actually collide around R74, then he has to diverge again so that when you add the IV (part of the process of creating the IV for the next block) they collide.

Many think integrated password managers create more vulnerabilities than they solve. https://lock.cmpxchg8b.com/passmgrs.html is a reasonable overview of this.

> So this article is bringing attention to a weakness in the browser’s built-in password managers, and suggesting a very viable and easy-to-adopt solution.

Because many actual experts disagree it is a weakness

> Why the strong criticism of this article?

The advice tries to make it out like browser suppliers are doing this to lower security for some unknown reason, whereas actually their model is safer than what is recommended.

It is possible to argue against browser suppliers here, but you need to look at their arguments for doing it that way. This article doesn't do that.

That is somewhat of an unfortunate myth. Computer security is not a matter of withstanding force (where "adding an additional wall" might help) but one of correct logic. One of the best ways to achieve the latter is to get rid of unnecessary logic altogether. AV software does the opposite: It adds tons of more logic that gets into contact with untrusted data, and thus adds exploitation risk to the system (aka "attack surface"). Also, there is a very specific reason why AV really is more an annoyance filter than a security measure: It's a blacklist.

For some practical examples for why AV is risky, see also:

https://lock.cmpxchg8b.com/sophail.pdf
https://lock.cmpxchg8b.com/sophailv2.pdf