Light

Episode #908 Quiz

Data Operand Independent Timing
Date: 2023-01-31 | Length: 1.5 hrs | Episode page at twit.tv

About this episode

Android 14 will block sideloaded and store-installed apps targeting obsolete APIs, reducing malware that abuses deprecated protections, while Microsoft blocks downloaded Excel XLL add-ins via Mark of the Web. Intel and ARM’s new data-operand-independent timing modes must be enabled for constant-time crypto; otherwise instructions like add, XOR, and AES can leak secrets.

Your name and email are stored only in your browser local storage for convenience. They are not retained server-side.

NameEmail

Question 1: According to the episode, what is the practical effect of Android 14's new handling of outdated apps on installation sources?

Question 1

According to the episode, what is the practical effect of Android 14's new handling of outdated apps on installation sources?

It blocks only apps that target Android 12 or newer It blocks sideloaded APKs and app-store installs for outdated targets It blocks only Play Store installs for outdated targets It allows sideloading but blocks all Play Store reinstalls

Question 2: What mitigation did Microsoft announce for Excel add-in files downloaded from the Internet?

Question 2

What mitigation did Microsoft announce for Excel add-in files downloaded from the Internet?

It will exempt zipped XLL files from the Mark of the Web It will block execution of downloaded XLL files inside Office apps It will quarantine downloaded XLL files only after the first launch It will block only XLL files received by email

Question 3: What did the FBI's covert access to the Hive ransomware infrastructure allow it to recover and distribute?

Question 3

What did the FBI's covert access to the Hive ransomware infrastructure allow it to recover and distribute?

More than 300 encryption keys for new Hive deployments More than 1,300 stolen wallets for victims More than 1,300 decryption keys for victims More than 130 million dollars in ransom payments

Question 4: Why did Steve say he would not use Bitwarden's feature for storing and auto-filling TOTP seeds?

Question 4

Why did Steve say he would not use Bitwarden's feature for storing and auto-filling TOTP seeds?

It collapses the second factor into the same master password system It makes one-time codes static once they are stored It requires FIDO-certified hardware keys on every login It prevents Bitwarden from syncing across devices

Question 5: In Intel's new data-operand timing model, what must software do to get the older constant-time behavior on affected processors?

Question 5

In Intel's new data-operand timing model, what must software do to get the older constant-time behavior on affected processors?

Disable AES instructions through the kernel Recompile applications with a constant-time compiler flag Set DIT to 1 for user space only Set DOITM to 1 for the logical processor

Cancel

My Data//Security & Privacy//Clear Local Data

© 2026 Ken ArmstrongSecurity Now™ is a trademark of TWiT LLC. All trademarks and copyrights of the Security Now podcast are respected and reserved to their respective holders.
This is a hobby project made with love and admiration for what Steve Gibson and Leo Laporte have built over 20 years.