david wong

Hey! I'm David, the author of the Real-World Cryptography book. I'm a crypto engineer at O(1) Labs on the Mina cryptocurrency, previously I was the security lead for Diem (formerly Libra) at Novi (Facebook), and a security consultant for the Cryptography Services of NCC Group. This is my blog about cryptography and security and other related topics that I find interesting.

Quick access to articles on this page:

more on the next page...

Heartbleed already being used to cash bitcoins posted April 2014

A message some users of Virwox received:

Hello,
here is what has happened:
Similar to other exchanges, our servers are protected from DDOS-attacks by an external service provider. While our own servers themselves were not vulnerable to the "Heartbleed" attack, the proxy servers of the DDOS provider were. They have fixed the problem already and we have turned on the service again.
The good news is that our own server was NOT hacked, and none of our secrets or bitcoins were stolen. However, the attacker was able to get to the session cookies of in total 20 users who were logged in yesterday (between about 8am and 11am), and used this to try to withdraw the money they had in their account in the form of bitcoins.

They don't say how much loss they have suffered, but they have reimbursed the victims.

comment on this story

My blog posted April 2014

p1x3l

p1x3l

I wanted to learn Python, so a few months ago (I forgot to post about it here!) I redid my old blog in Django.

It's way different than PHP but it was a lot of fun :) I love learning different technologies. You can check it out here but be careful, it's in french!

Here's a list of what I want to learn right now:

  • QT with C++
  • Unity
  • Android applications
comment on this story

Brackets posted April 2014

I recently advised a colleague to try Brackets since he's learning html, css, etc...

But I've never really used it myself for a project. I've tried it, found it really cool, but never had a chance to start a project with it yet. As I was trying to convince my colleague to give it a try I ran into this cool video from Jeffrey Way the guy who made Tutsplus (and the amazing sublime text tutorial) Check it out!

comment on this story

Fast Fourier Transform posted April 2014

So, I've learned about Fourier every year in my bachelor of Mathematics and I'm learning about the efficient algorithm dealing with the Fourier Transform in my class of Algebra right now.

I found a really nice video explaining really quick what it is, concretely.

Here's wikipedia way of showing that fourier made by LucasVB, this crazy guy doing all those math gifs you've probably seen before :) more here

There's also a visualization in d3.js here: http://bl.ocks.org/jinroh/7524988

comment on this story

Long polling and webhooks posted April 2014

I remember reading about how the newly facebook chat was made using long pollings, years ago. Now with HTML5 with have sockets and webhooks made easy. I wonder if they're still using long polling now...

Anyway, Zapier. A start up that is making APIs easy, is writing a lot of interesting tutorials these last few months. Their new Chapter 7 was released and it's about polling and web hooks. And as usual it's great!

https://zapier.com/learn/apis/chapter-7-real-time-communication

1 comment

OpenSSL is written by monkeys posted April 2014

After messing around with this code for about a month I decided to write this up for the tubes in the hope that I can save some souls. I have come to the conclusion that OpenSSL is equivalent to monkeys throwing feces at the wall. It is, bar none, the worst library I have ever worked with. I can not believe that the internet is running on such a ridiculous complex and gratuitously stupid piece of code. Since circa 1998 the whole world has been trusting their secure communications to this impenetrable morass that calls itself the "OpenSSL" project. I bet that the doctors that work on that shitshow can not prescribe anything useful either!

worrying essay, read it here: https://www.peereboom.us/assl/assl/html/openssl.html

comment on this story

Heartbleed : serious vulnerability in open SSL posted April 2014

We have tested some of our own services from attacker’s perspective. We attacked ourselves from outside, without leaving a trace. Without using any privileged information or credentials we were able steal from ourselves the secret keys used for our X.509 certificates, user names and passwords, instant messages, emails and business critical documents and communication.

A pretty bad bug has been found in open SSL during the Codenomicon. more info here: http://heartbleed.com/

List of vulnerable websites from the Alexa top 10,000 websites: https://gist.github.com/dberkholz/10169691

You can test a website here: http://filippo.io/Heartbleed/

And also, if you have a lot of time to waste, this random dude seems to know a lot about it :D

comment on this story