I think your reply is a little too strident. It’s not a “fake idea”. It’s just someone’s idea. I hadn’t heard of it but I googled it upon reading this thread and it seems to be the idea that people tend to collectively remember things inaccurately in the exact same way. That phenomenon alone seems pretty plausible and not that dumb or fake, right?
But what isn’t plausible is the part you left out that’s talked about in the video? That some people explain the Mandela effect through pseudoscientific bullshit like alternative timelines merging. You also seem to conflate the ridiculousness of what some people collectively remember with the Mandela effect concept as a whole. It’s a bit like saying hypnosis as an idea is dumb because people do dumb things when hypnotised? I also don’t understand what is deeply offensive about people misremembering that Mandela died in prison? They’re not saying (or even remembering) that he was a bad person, probably the opposite, they’re just ignorant of history.
But having said all that I am perplexed by the OP comment: “I can’t help but think the Mandela effect is an example”. An example of what? Cracks in spacetime? Because yeah that’s dumb, though probably a joke.
Chess GMs at Magnus and Hans’ level wouldn't even need to cheat on every move and certainly not on any opening where something like the first 20 best moves are all memorised. These guys would only need the engine to tell with them one or two moves per game to pretty much always win.
Why did Magnus start the game and then resign? Maybe he thought it would make a statement. Maybe he needed to technically show up to the game to avoid a penalty.
I’ve exercised probably 90% of days for the last ten years. Days when I don’t are just rest days or travel days. To be honest, I think it’s best just to make it a habit like brushing your teeth. Working out is just what you do, and it’s a weird day if you don’t. Being highly motivated is kind of fleeting and just boring routine is more important.
Perhaps I’m looking into the data too much, but it doesn’t surprise me that 0 is often the neutral white, black or grey, and that, because we use the base 10 number system, the pattern is the same for 10. These colours and numbers are both “clean”. It’s the same for 2: the most popular colours are blue, yellow, red then green, and that pattern is repeated for 20. Of course, this “pattern” is already broken since it should be 1 with the same pattern as 10 and 2 wirh the same pattern as 20. It would be interesting to see if patterns do indeed emerge with more data. I would certainly expect 100, 1000, 1,000,000 to often be white, black or grey.
For myself, I’ve always associated colours with days of the week. I don’t know if others have this, but it’s always felt more “obvious” what colours some days of the week are compared to others, like the feeling is stronger or the colour is more brilliantly defined. But I do wonder to what extent it may have just been me as a child tricking myself into thinking I’m special, and I’ve just forever embedded those colour memories, because it’s really not like if someone tells me “Wednesday” I automatically experience a powerful crimson red; I have to kind of ask myself: “what colour is Wednesday?” to experience it in my mind’s eye.
100%. I found the books “how to have impossible conversations” and “crucial conversations” helpful for me, but in a nutshell they’re basically “say things in a way that protect the other side’s ego”
What would happen (most likely) is that the wave function collapses and you find yourself in a universe where the random number you chose is not in fact a divisor and so, according to your algorithm, you now have to kill yourself. Probably, you don’t feel like doing it and so this algorithm does not work.
Thanks for the responses. I hope it was useful to go through. Yeah, I think the salient points are that the sid is not all 0 but mostly 0 in one case and Fermat's Little Theorem basically make the math work out. I suspect the authors thought of this clever attack because they were already thinking about fault attacks on RSA where perhaps similar concepts come up.
I predict with some confidence this will be made into a CTF soon if it hasn't already so we may as well work on the code now ;-)
The fact that you also are a little fuzzy on the details gives me some confidence that I do in fact have some imposter syndrome ;) Thanks for your response. I understand it takes some work to parse these papers and I'm lazily just asking questions here instead of reading the paper myself, but I think I'm quite good at asking precise questions to get to the bottom of stuff, so I hope it will help others who stumble across this thread.
> We're in the bizarre circumstance of being able to get our target to use a partially corrupted version of their own secret RSA key to decrypt a message of our choosing (this never happens! Only with Mega!).
We overwrite the ciphertext of q^{-1} so that is fully corrupted (or at least, because it is ECB mode, a block of it is corrupted), right? By partially corrupted, do you mean "p and q are fine, but q^{-1} is not what it is supposed to be"? Does it matter how we corrupt q^{-1}? Is it just a bit flip in a single block? Do we have to corrupt it the same every time to make a new guess for q?
> We set m, the plaintext message we get to choose, to the middle of the range of possible q's. Remember, q is smaller than m;
I'm not quite following this part. To clarify, are you saying (roughly, I know RSA has some checks that q is not outrageously small) q lies in the interval [0, 2^1024] and we, on our first guess, set m = (2^1024 - 0)/2 = 2^1023? Then the adversary encrypts this guess m using the public key N from the client. m, when decrypted by the client at this point, could clearly be either larger or smaller than q, right? Our choice for m is literally in the middle. But the client also pads the resulting m, so it will certainly be larger than q? But to clarify, q is only (almost certainly) smaller than m because of the padding that the client adds?
> * If m < q, the message is going to miss our faulted qInv
I'm confused again, sorry. Is this m without the padding, right? Why, if m < q, does the RSA calculation not wrap around the modulus? I'm a bit confused how it pulls out only 0s, but this is probably related to my confusion at the last paragraph. Is it that it's that only 0s, but rather a small number followed by a ton of padding of 0s?
> * If m >= q, our qInv fucks up the decryption; we decrypt (I assume) random gibberish
The whole reason we fault qInv is so this case screws up while the other doesn't, right? And so it doesn't really matter how we fault qInv each time? This case faults because the calculation wraps around the modulus? It would be good to see the actual calculation and why this is which I think is my main struggle right now.
I think I understand the attack at a high level but I’m still not sure on some details.
Could someone explain how the math works to provide the oracle? In particular, the exact values the malicious server inserts as the encrypted sid and q^(-1), and why, if the guess for q is lower than the real q the plaintext sid the client sends back is 0, and why it’s not zero if the guess is higher?
Am I right in thinking the attacker simply randomly flips a bit in q^(-1)? Why do they need to do this? Do they flip different bits on different guesses? And then how do they encode their guess for q in the encrypted sid? And why, exactly does this provide an oracle? How does the subsequent lattice search need only half as many guesses as binary search? Finally, does this attack require the victim to actually type their password in 512 times?
A lot of users will simply change their passwords by appending a 1, 2, 3, etc. at the end. Presumably if old passwords did sour and become compromised then Hashcat would easily crack the minor tweak on the new password.
To be fair to these companies, the reason they do passwords so terribly is because of such poor guidance and standards in the past. Even now NIST has SP 800-132 for guidance on generating a cryptographic key from a password for storage applications, which is different and often confused with guidance on storing passwords (which they don’t give advice for). There they say to use PBKDF. Also, compliance standards such as PCI don’t allow for modern storage like Argon2, so at best companies use something like bcrypt.