Light

Episode #997 Quiz

Credential Exchange Protocol
Date: 2024-10-22 | Length: 2 hrs | Episode page at twit.tv

About this episode

The episode debunks claims that Chinese researchers broke RSA, noting they only factored a 22-bit integer with a D-Wave quantum computer; practical 8192-bit RSA remains safe.

Your name and email are stored only in your browser local storage for convenience. They are not retained server-side.

NameEmail

Question 1: According to the episode, what was the actual result of the Chinese researchers' work that was misreported as having broken RSA encryption?

Question 1

According to the episode, what was the actual result of the Chinese researchers' work that was misreported as having broken RSA encryption?

They factored a 22-bit RSA integer using a D-Wave quantum computer. They demonstrated a full cryptographic break of RSA signatures in production systems. They factored an 8,192-bit RSA public key using a D-Wave quantum computer. They recovered a 4,096-bit RSA private key from a public key listing.

Question 2: What specific problem did the National Public Data breach data enable in the extortion scam Steve described?

Question 2

What specific problem did the National Public Data breach data enable in the extortion scam Steve described?

It let the scammers address the victim by name, phone number, and street address. It let the scammers decrypt the victim's email and read private messages. It let the scammers impersonate the victim's bank and reset account credentials. It let the scammers prove the victim had visited adult websites by recovering browser history.

Question 3: What did the EU directive say about contractual attempts to waive software liability?

Question 3

What did the EU directive say about contractual attempts to waive software liability?

It said consumers must accept liability limits before installing any software. It said no contractual derogations should be permitted. It said vendors could cap liability through standard license terms. It said liability could be waived only for open-source software.

Question 4: In the CXP sketch, how does the protocol derive the shared encryption key for credential transfer?

Question 4

In the CXP sketch, how does the protocol derive the shared encryption key for credential transfer?

A central FIDO registry generates a symmetric key for both providers to share. The importer creates a password, and the exporter reuses it to wrap the payload. The exporter encrypts credentials with its private key, and the importer decrypts with the public key. Each side generates a Diffie-Hellman key pair and derives a shared migration key.

Question 5: What did the episode say Microsoft's phishing-honeypot bots did when they encountered phishing sites?

Question 5

What did the episode say Microsoft's phishing-honeypot bots did when they encountered phishing sites?

They routed victims into a password-reset flow that exposed real customer credentials. They blocked the phishing sites immediately and deleted all attacker infrastructure. They impersonated support staff and called attackers to negotiate shutdown terms. They pretended to be fooled users and submitted fraudulent credentials to fake Azure tenants.

Cancel

My Data//Security & Privacy//Clear Local Data

© 2026 Ken ArmstrongSecurity Now™ is a trademark of TWiT LLC. All trademarks and copyrights of the Security Now podcast are respected and reserved to their respective holders.
This is a hobby project made with love and admiration for what Steve Gibson and Leo Laporte have built over 20 years.