Top all-time · #20203
Eric Rafaloff
Personal blog · ericrafaloff.comsecurityprogramming
Eric Rafaloff's personal blog at ericrafaloff.com covers security and programming. Since 2015, 3 different Hacker News readers have linked it 21 times, most often “Shamir’s Secret Sharing Scheme”. The last post was in 2024, but the archive is still widely read.
Hi! I’m a cybersecurity researcher who lives in NYC. I mostly write about computer science, cryptography, life, and music....
Most-linked posts?
- Shamir’s Secret Sharing Scheme2 people · 2 mentions · first linked 2018-11-02
What Hacker News says?
The vulnerability was extremely simple, as suggested by the three keyword-long patch. I've written about this and other Solidity/EVM bugs from a technical perspective, if anybody is curious: - https://ericrafaloff.com/parity-multi-sig-contract-vulnerabi... - https://ericrafaloff.com/analyzing-the-erc20-short-address-a... I think at least a big part of the solution to these security problems is two-fold: - More secur…
Comment linking /analyzing-the-erc20-short-address-attack/
on “153k Ether Stolen in Parity Multi-Sig Attack”Submitted Shamir’s Secret Sharing Scheme as a story · 213 points
HN discussionYou should also make sure providers like Google don't fall back to less secure account recovery methods. I blogged about this here, after I realized that I was still vulnerable even while using real 2FA: https://ericrafaloff.com/google-account-security-and-number-...
Comment linking /google-account-security-and-number-portability/
on “Hackers Are Hijacking Phone Numbers and Breaking into Email, Bank Accounts”Submitted Shamir’s Secret Sharing Scheme as a story · 14 points
HN discussionUpdated link with corrected title: https://ericrafaloff.com/biased-nonce-generation-in-putty-fo...
Comment linking /biased-nonce-generation-in-putty-for-nist-p-521-keys/
on “PuTTY vulnerability vuln-p521-bias”Submitted Key Shards and Shamir’s Secret Sharing Scheme as a story · 6 points
HN discussionI did a bit of a deep dive into this, in case anyone is interested. I think reading the code is a great way to understand _why_ this vulnerability happened: https://ericrafaloff.com/your-putty-generated-nist-p-521-key...
Comment linking /your-putty-generated-nist-p-521-keys-are-compromised/
on “PuTTY vulnerability vuln-p521-bias”Submitted Analyzing the ERC20 Short Address Attack as a story · 4 points
HN discussionManual code review would have likely helped. A tool like this maybe? https://ericrafaloff.com/introducing-the-solidity-function-p...
Comment linking /introducing-the-solidity-function-profiler/
on “A hacker stole $31M of Ether – how it happened, and what it means for Ethereum”Submitted Running Your Own Private Ethereum Network as a story · 4 points
HN discussionGreat article. I recently wrote a tool to help find bugs like this: https://ericrafaloff.com/introducing-the-solidity-function-p...
Comment linking /introducing-the-solidity-function-profiler/
on “Parity's Wallet Bug Is Not Alone”Submitted Key Shards and Shamir’s Secret Sharing Scheme as a story · 2 points
HN discussionSubmitted Pervasive Open Redirect in GitLab as a story · 2 points
HN discussionSubmitted XSS via DOM-Based Open Redirect as a story · 2 points
HN discussionSubmitted Server Performance Monitoring as an API as a story · 2 points
HN discussionSubmitted Introducing the Solidity Function Profiler as a story · 1 points
HN discussionSubmitted Param Tampering Attack on Twitter Web Intents as a story · 1 points
HN discussionSubmitted The Power of Go Generators as a story · 1 points
HN discussionSubmitted To_gist – automagically create gists from stdout as a story · 1 points
HN discussionSubmitted OpenSSL and the Impending Doom of the Internet as a story · 1 points
HN discussion