Light

Episode #876 Quiz

Microsoft's Patchy Patches
Date: 2022-06-21 | Length: 2 hrs | Episode page at twit.tv

About this episode

The episode explains why double encryption resists divide-and-conquer brute force: a correct inner key yields no recognizable plaintext because strong ciphers produce entropy-like output. It also notes FIDO2 passkeys need cross-device synchronization, warns of lock-in, describes Firefox’s cookie isolation, DDoS growth, NTLM relay abuse, and deserialization RCEs in Windows, WordPress, and Java.

Your name and email are stored only in your browser local storage for convenience. They are not retained server-side.

NameEmail

Question 1: Why did Steve say the double-encryption thought experiment does not reduce to a divide-and-conquer attack like the WPS PIN flaw did?

Question 1

Why did Steve say the double-encryption thought experiment does not reduce to a divide-and-conquer attack like the WPS PIN flaw did?

Because the inner 256-bit key can be recovered from the ciphertext header without trying any outer keys. Because AES adds a check digit to the plaintext that prevents partial verification of either key half. Because the first decryption output is indistinguishable from entropy, so there is no feedback signal to tell when the outer guess is right. Because the two 256-bit keys are combined into a single 512-bit key before encryption begins.

Question 2: What specific limitation of FIDO's current passkey proposal did Steve identify as the main usability problem for cross-vendor users?

Question 2

What specific limitation of FIDO's current passkey proposal did Steve identify as the main usability problem for cross-vendor users?

It forces users to re-enroll each passkey after every browser update. It lacks a bulk-transfer mechanism for moving passkeys between ecosystems. It prevents WebAuthn servers from accepting passkeys generated by mobile devices. It requires every passkey to be stored only on a single roaming hardware token.

Question 3: According to the Bitwarden forum answer Steve cited, what FIDO2/WebAuthn capability did Bitwarden already support at the time?

Question 3

According to the Bitwarden forum answer Steve cited, what FIDO2/WebAuthn capability did Bitwarden already support at the time?

Using FIDO2 WebAuthn as a second factor to unlock the vault. Exporting all stored passkeys automatically into any other password manager. Issuing FIDO2 passkeys to websites directly as a consumer-facing authenticator. Using passkeys as a replacement for the master password on every login.

Question 4: What did Steve say was necessary to make Firefox's Total Cookie Protection test actually show third-party-cookie blocking on his system?

Question 4

What did Steve say was necessary to make Firefox's Total Cookie Protection test actually show third-party-cookie blocking on his system?

Blocking all third-party cookies instead of relying on the default protection settings. Enabling only cross-site tracking protection while leaving other cookies untouched. Turning on the browser's standard privacy mode without changing any cookie settings. Clearing the browser cache before every visit to the cookie forensics page.

Question 5: What sequence did Orca Security describe in the Azure Synapse vulnerability remediation that showed Microsoft needed multiple patches?

Question 5

What sequence did Orca Security describe in the Azure Synapse vulnerability remediation that showed Microsoft needed multiple patches?

Microsoft issued one emergency patch, Orca validated it as complete, and the issue was closed the same day. Microsoft deployed an initial patch, Orca bypassed it, Microsoft patched again, Orca bypassed that too, and a third patch was finally needed. Microsoft paused the service entirely until customers manually migrated to a new tenant architecture. Microsoft revoked all Azure Synapse certificates first and then later discovered the code flaw.

Cancel

My Data//Security & Privacy//Clear Local Data

© 2026 Ken ArmstrongSecurity Now™ is a trademark of TWiT LLC. All trademarks and copyrights of the Security Now podcast are respected and reserved to their respective holders.
This is a hobby project made with love and admiration for what Steve Gibson and Leo Laporte have built over 20 years.