Hacker News Reader

Oh wow. ECB mode? That's horrifying.

For those that don't know much about encryption, here is an example image for why ECB mode is trash: https://i.stack.imgur.com/bXAUL.png

I would say that anyone who ever tries to encrypt some data and does the bare minimum google/stackoverflow search for how to do it would see extremely vigorous warnings not to touch ECB with a 10 foot pole.

Unfortunately, crypto libraries have a history of having a terrible UI and defaulting to ECB. Years ago I ran into this with pycrypto. I worked on a team that joked about how important it was not to do ECB and it turns out they had done ECB. https://www.dlitz.net/software/pycrypto/api/current/Crypto.C...

Images are uniquely bad for ECB mode since they almost definitionally will have repeated material. ECB mode is bad and shouldn't be used. But it isn't like somebody listening to your zoom traffic can transparently see penguins.

Isn't an h264 stream even worse given that unlike a random image it has a very well defined repeating structure? The risk isn't that someone will look at zoom traffic directly and see the content Matrix-style. The risk is that it should become possible to just completely decode the encryption given what you know about the plaintext. In that context the penguin image is a great illustration.

Reply on news.ycombinator.com