Top all-time · #5309
Random Oracle
Personal blog · randomoracle.wordpress.comsecurityeconomics
Random Oracle is a personal blog at randomoracle.wordpress.com about security and economics. Since 2013, 15 different Hacker News readers have linked it 18 times, most often “Filecoin, StorJ and the problem with decentralized storage (2019)”. It is still writing: the last post was on 2026-09-28, and you can follow it by feed.
Too few sampled comments (8) to say how often HN recommends it.?
Why HN links it
HN commenters link Random Oracle to explain how card security codes (CVV1, CVV2, CVV3) and magnetic stripe and NFC data work, and also cite it on crypto, TOTP, BitLocker and passport chip security.
Summarised by Claude from a sample of 8 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Building and breaking systems
Most-linked posts?
- /2012/08/25/cvv1-cvv2-cvv3-demystifying-credit-card-data-12/2 people · 2 mentions · first linked 2017-03-04
- Filecoin, StorJ and the problem with decentralized storage (2019)2 people · 2 mentions · first linked 2021-04-22
- On Safenet HSM key-extraction vulnerability CVE-2015-5464 (part I)2 people · 2 mentions · first linked 2015-08-14
What Hacker News says?
CVV is not just more entropy, it's handled differently: https://randomoracle.wordpress.com/2012/08/25/cvv1-cvv2-cvv3... The whole point is that you can't skim the CVV2 from the magnetic data and then use it to make purchase.
Comment linking /2012/08/25/cvv1-cvv2-cvv3-demystifying-credit-card-data-12/
on “What happens when you swipe a credit card”Submitted Filecoin, StorJ and the problem with decentralized storage (2019) as a story · 126 points
HN discussion> cheap loans a loan that might double in the amount of fiat you have to pay back isn’t cheap, it’s nuts. Also there’s significant cost converting to and from fiat to take it out > filecoin https://randomoracle.wordpress.com/2019/12/07/filecoin-storj... > LabDAO Toucan Golden.xyz Why not just a centralised database though? > Radicle.xyz OK sure, if you have code that GitHub won’t accept, then this looks ok, but pres…
Comment linking /2019/12/07/filecoin-storj-and-the-problem-with-decentralized-storage/
on “Where are all the crypto use cases?”Submitted Off-by-One: The Curious Case of 2047-Bit RSA Keys (2019) as a story · 48 points
HN discussionBitlocker is a bad idea. http://randomoracle.wordpress.com/2013/09/16/all-your-keys-a...
Comment linking /2013/09/16/all-your-keys-are-belong-to-us-windows-8-1-bitlocker-and-key-escrow/
on “CipherShed, the Truecrypt fork”Submitted On Safenet HSM key-extraction vulnerability CVE-2015-5464 (part I) as a story · 11 points
HN discussionOh I took that part for granted. Sorry. I don't know how it is implemented, and this source is not a scholar paper, but worth looking. http://randomoracle.wordpress.com/2012/08/25/cvv1-cvv2-cvv3-... > Swipe transaction are perhaps easiest to describe. The data encoded on the magnetic stripe is static, formatted according to ISO7813 in three tracks, with the third one typically unused. One of the fields in this track…
Comment linking /2012/08/25/cvv1-cvv2-cvv3-demystifying-credit-card-data-12/
on “Credit card data of 40 million shoppers stolen from Target stores”Submitted Bitcoin’s meta problem: governance (part II) as a story · 2 points
HN discussionI followed the steps here[1] to get the Authy TOTP token and then put it in 1Password. One less app I have to deal with. [1] https://randomoracle.wordpress.com/2017/02/15/extracting-otp...
Comment linking /2017/02/15/extracting-otp-seeds-from-authy/
on “Coinbase is a hot mess”Submitted On Safenet HSM key-extraction vulnerability CVE-2015-5464 (part I) (2015) as a story · 2 points
HN discussionIt's my understanding that the CVV3 is cryptographically generated for each transaction (like HOTP), and that the cardholder's name is not available over NFC. So you can't steal personal information or use the card undetected. A bit of reading regarding the CVV3: http://randomoracle.wordpress.com/2012/09/11/cvv3-demystifyi... I'm not 100% sure about the name not being there, however.
Comment linking /2012/09/11/cvv3-demystifying-credit-card-verification-part-2/
on “Credit card data can be stolen with a wave and an app”Submitted Second-Guessing Satoshi: ECDSA and Bitcoin (part I) as a story · 2 points
HN discussionI think this topic came up a week or 2 ago, and I made an almost identical comment as you, which was why the content of my reply was fresh in my memory. Anyway, in the recent convo, a kind hn poster provided this explanation of CVV https://randomoracle.wordpress.com/2012/08/25/cvv1-cvv2-cvv3... I totally see why it just seems like "moar numbers" though, and I find them unnecessarily annoying. I wish they could reduc…
Comment linking /2012/08/25/cvv1-cvv2-cvv3-demystifying-credit-card-data-12/
on “Delta Dental says data breach exposed info of 7M people”Submitted Browser in the middle: 25 years after the MSFT antitrust trial as a story · 1 points
HN discussion[1] says the decryption key is derived from those pieces of information, and the key derivation logic is public info, e.g. [2] is an implementation. It's somewhat clever, if someone takes a photo of the first page, they already have your personal info, to steal it from the chip they still need to have visual on the info on that page. [1] https://randomoracle.wordpress.com/2012/08/27/reading-the-us... [2] https://git…
Comment linking /2012/08/27/reading-the-us-passport-using-an-android-phone-overview/
on “The New Swiss Passport”Submitted Flash loans and the democratization of market manipulation as a story · 1 points
HN discussionSubmitted Looking back on the Google Wallet plastic card as a story · 1 points
HN discussionSubmitted Downside to security standards: when vulnerable is better than uncertified as a story · 1 points
HN discussion
