ibmthrowaway218

The new CEO will not tolerate new unethical behaviour.

Hopefully he will also slowly eradicate the existing unethical behaviour.

I think there's some obfuscation in the tests:-

As you say, the first few test numbers correspond just to simple divisor checks:-

Prime 3 paired with check number 6 (binary 110). So 1 << (n % 3) will only ever be 'safe' if n % 3 == 0, which is 'super bad' as you put it.

(2^3)-2 = 6

(2^5)-2 = 30 so this is a similar division check

(2^7)-2 = 126 ditto

I think these are just here as distractions as it starts to sometimes do different things at p=11

11 is paired with check number 1026, which is (2^10)+2 not (2^11)-2). So under what conditions does:-

( 1 << (n % 11) ) & 1026 != 0

Given 1026 only has two bits set (1024 and 2) it's a rather specific test for (n%11) = 1 or 10. All other residues would be safe.

Don't have time to investigate further for the other primes and check numbers but I can only think of some kind of p-1 or p+1 smoothness they can detect this way.

> Also, I'm having a bit of a hard time understanding the attack.

He forces them to connect to his own AP and forwards all traffic to the destination so that the client is unaware it has been redirected.

He then forces the client to re-install the key which (on anything that is derived from wpa_supplicant e.g. Linux, Android, etc) the client has blanked out after first use, so the key it reinstalls is now all zero bytes.

He can continue to forward the traffic to the destination so that the client gets responses, but now he can decrypt all of the traffic too.

For clients that re-install the correct key (which the account does not recover in any way) the attacker has to rely on snooping enough encrypted data in order to perform a birthday attack as the key re-installation also resets the frame counters which leads to nonce-reuse which is a problem in ciphers like AES-GCM.

> The client is forcibly disconnected from the WiFi network and reconnects to the attackers network instead.

The client is tricked into moving to what it thinks is the same WiFI network running on a different channel, but is actually the attackers network instead.

> The attacker doesn't need to know the WPA2 password but it accepts the connection setting the encryption to zeros.

The attacked doesn't need to know the WPA2 password and (for Android and Linux clients) the client then defaults to an encryption key of all zero bytes.

> The client thinks it is connected to the original wifi network and continues as normal.

Yes.

> Wifi traffic is intercepted and unencrypted.

Wifi traffic is intercepted and can be decrypted (since the encryption key - all zero bytes - is now known).

Except the attack doesn't get you access to their wireless network. It allows you to redirect someone from their wireless network to your own (spoofed) wireless network and then you can snoop the traffic.

Both were influenced by _We_ by Yevgeny Zamyatin.

Um, yes, that's exactly what this article is about.

Depends, for a first time buying couple it's a 10% deposit (plus £45k for stamp duty) and then a combined salary of £225k (assuming 4x multiplier on combined income). Sure ~£110k/year is firmly in the top quartile of dev salaries, but not out of the question.

More than likely a couple who are already earning ~£70k/year each probably already have some equity in a current home, so a £1m home might not be much of a step up for them.

> I will replace my iPhone 5 with one of these.

I probably will too (currently on an iPhone 5) given that my current strategy is to replace my phone every 2 years by buying a refurbished model with 12 month warranty for ~£150 from eBay. I usually get ~£50 or so for each old phone so the physical phone only costs me £4 a month.

4GB data (4G), unlimited texts and unlimited minutes for ~£20 a month here in the UK. Was always amazed at the price of plans in the US, luckily I never had to pay my own bill when I lived there.

Domestic flights within the UK don't require passports (although the airlines may require some form of ID to be presented in order to get boarding passes).

"marginal improvement" was the key phrase