From Newsgroup: alt.privacy
SEC3 wrote:> Pretty neat:
https://aliceandbob.io/
This post is exclusively about the online version of aliceandbob.io:
I've just completed a security review of the Alice & Bob Go implementation (
https://github.com/aliceandbob-io/aliceandbob ) and must raise a serious red flag: there is no runtime protection for private keys in memory.
Unlike hardened implementations, like the one written by myself
(e.g.,
https://github.com/gabrix73/Nofuture-Go-Memguard ),
https://safecomms.virebent.art/
which use memory locking, anti-dump measures, ptrace restrictions, and defense-in-depth against local root compromise, Alice & Bob's code:
Stores private keys in regular Go heap memory (subject to GC, swapping, core dumps).
Does not lock pages with mlock or equivalent.
Does not disable core dumps or restrict /proc/<pid>/mem access.
Does not prevent debugging or memory scraping via gcore, ptrace, or forensic tools.
Assumes a trusted local environment, a dangerous assumption in 2024.
This means: if an attacker gains local access (even non-root in some cases, or root via escalation), they can trivially extract private keys from memory, complete identity theft with zero resistance.
Gabx
--- Digital Signature --- SirSFqC7abaRw9gpYW8Ej+lK/lc/2AgCdSRLSG0G2FUv6CM/eM/0FaqGk7gzawEefBzCaXXbDPg3UPAroAdjAQ==
--- Synchronet 3.21a-Linux NewsLink 1.2