Since he doesn’t mention it in his ‘fantastic’ reporting, OpenSSH 9.6 was released Monday that will patch this attack.
I am tempted to delete this post just for the article’s stupid clickbait headline, but it still will probably cause some people to go update their OpenSSH installs, so… meh.
Anyone who actually wants to know details of the vulnerability should read the website about it which is obviously much better than this article.
Also, since he doesn’t mention it, if on the Internet, the MITM would have to be installed at both end points (client side and server side) to be effective without the patch.
Huh? No. The attacker doesn’t need to be in two places or even near either end per se, they could be located at any fully on-path position between the client and server.
I have mixed feelings about this article. It gets some stuff right, but also some stuff wrong and it misses some important details.
I don’t think Signal has actually received money from OTF (Radio Free Asia) since 2015 or so; if it needed any today it would likely get it from one of the less transparent US government internet freedom funding vehicles. There is no indication they are “facing collapse” beyond a blog post talking about their expenses and soliciting donations.
This article mentions “over a billion” people repeatedly, but doesn’t explain that number is actually referring to WhatsApp (which uses the encryption protocol developed by Signal). Signal says they have 40 million active users.
It doesn’t mention that Brian Acton (billionaire WhatsApp founder) gave them a $50M interest-free loan when he co-founded the Signal Foundation with Moxie in 2018, and became its “executive chairman” or whatever. That “loan” had increased to over $100M by the end of 2018, and is presumably much larger today.
It doesn’t mention that Signal Foundation president Meredith Whittaker worked at Google for over a decade, and co-founded a department there that worked alongside OTF on various internet freedom projects (and was later on the OTF advisory board herself)
it doesn’t mention the salient properties of Signal which actually make it particularly beneficial to US interests (keeping the communications of privacy-desiring people associated with their phone numbers while concentrating their metadata on Amazon servers)