Sign in

Kenny Paterson

@kennyog.bsky.social
774 followers 324 following 72 posts

Bit flipper

PostsRepliesMedia
Kenny Paterson @kennyog.bsky.social · 04/10/2026
Glasgow would like a word.
040
Kenny Paterson @kennyog.bsky.social · 14/09/2026
Two things: 1) the attacks are only possible when an attacker can inject chosen plaintext near a target string, 2) fixed length chunking does not protect you in general because an attacker who can inject can push the length close to a chunk boundary and then use the number of chunks as a proxy.
030
Kenny Paterson @kennyog.bsky.social · 13/09/2026
TL;DR: using compression before encryption is much weaker than we thought. Tiny length differences can be amplified - almost without limit - and noise-based or bucketization countermeasures are then easy to bypass. Joint work with @prefix-free.bsky.social and Lenka Mareková, to appear at CCS 2026.
12415
Reposted by Kenny Paterson
Helger Lipmaa @helger.bsky.social · 10/09/2026
<- real-world kleptography ^ real-world human stupidity |
121
Kenny Paterson @kennyog.bsky.social · 10/09/2026
Current status:
1130
Kenny Paterson @kennyog.bsky.social · 10/09/2026
If you want to be truly terrified, check out Andris’ Master’s thesis, where he reports 56 vulnerabilities against SEPPmail, including RCE. ethz.ch/content/dam/...
ethz.ch
140
Kenny Paterson @kennyog.bsky.social · 10/09/2026
Our latest “Crypto in the Wild” project, analysing secure email gateways. We give 29 cryptographic attacks on 4 different products, from SEPPmail, Cisco, Proton and CipherMail. Paper to appear at ACM CCS 2026.
11911
Kenny Paterson @kennyog.bsky.social · 05/09/2026
A bit “inside academia” I know, but REF 2029 is going to be pretty catastrophic for Divinity @ Cambridge. Still, maybe a good impact case study to be written… 🤣 #JamesOrr
030
Kenny Paterson @kennyog.bsky.social · 05/09/2026
I tried to infer this information from Cambridge’s divinity department’s webpages but they are a bit … opaque.
000
Kenny Paterson @kennyog.bsky.social · 05/09/2026
Does anybody know if James Orr has a 100% position at Cambridge? Because if he does, then his department is not getting much value for money - not really REFable, and seems to spend more time in Mayfair clubs than in student tutorials. #orr #reform #scandal #UKacademia
120
Kenny Paterson @kennyog.bsky.social · 19/08/2026
If you read one thing today, read this piece on the death of Jason Arday and what it says about contemporary Britain. Will Self nails it completely. And elegantly. And with a beautiful fury. willself1.substack.com/p/2089334077...
willself1.substack.com
Jason Arday: J'Accuse the British Media
After the death of Jason Arday, Will Self asks what happens when the media machine mistakes what interests the public for the public interest.
051
Kenny Paterson @kennyog.bsky.social · 15/08/2026
Signal is the gold standard for secure messengers. We broke Signal’s integrity (twice) in this paper via message injection attacks. @kientuong114.bsky.social presented this week at #USENIX and he and Noemi will present it again at #WAC (Crypto workshop) this weekend. Catch their talk if you can!
02911
Reposted by Kenny Paterson
Count Binface @countbinface.bsky.social · 11/08/2026
An American interviewer asked me about my political beliefs. #VoteBinface
12940201067
Kenny Paterson @kennyog.bsky.social · 19/07/2026
You’re going to find cryptography … challenging.
000
Kenny Paterson @kennyog.bsky.social · 11/07/2026
Apollo butterfly, Haute Savoie, France.
180
Kenny Paterson @kennyog.bsky.social · 11/07/2026
Country sunset in the fields above Ugine, France.
060
Kenny Paterson @kennyog.bsky.social · 09/05/2026
Please help me caption this screenshot.
061
Reposted by Kenny Paterson
Ars Technica @arstechnica.com · 17/02/2026
arstechnica.com
Password managers' promise that they can't see your vaults isn't always true
Contrary to what password managers say, a server compromise can mean game over.
25628
Kenny Paterson @kennyog.bsky.social · 17/02/2026
A thread in which @sockpuppet.org presents some of the juiciest morsels from our paper at zkae.io :
zkae.io
Zero Knowledge (About) Encryption
0121
Kenny Paterson @kennyog.bsky.social · 17/02/2026
A very nice blogpost explaining our work - slices right through the marketing from the vendors: medium.com/reading-sh/y...
medium.com
Your password manager’s ‘zero knowledge’ promise is broken
What ETH Zurich’s USENIX Security paper means for anyone who stores passwords in the cloud.
021
Kenny Paterson @kennyog.bsky.social · 16/02/2026
We didn’t go as deep on 1password as the others. Probably some interesting things still to be found there.
130
Kenny Paterson @kennyog.bsky.social · 16/02/2026
@dashlane.com advisory: support.dashlane.com/hc/en-us/art...
support.dashlane.com
Security advisory: Cryptography downgrade issue
OverviewDashlane has fixed an issue that, if Dashlane’s servers were fully compromised, could have allowed a downgrade of the encryption model used to generate encryption keys and protect user vaul...
040
Kenny Paterson @kennyog.bsky.social · 16/02/2026
ETH news article abkut the work: ethz.ch/en/news-and-...
ethz.ch
Password managers less secure than promised
Researchers from ETH Zurich have discovered serious security vulnerabilities in three popular, cloud-based password managers. During testing, they were able to view and even make changes to stored pas...
171
Kenny Paterson @kennyog.bsky.social · 16/02/2026
Now we can finally tell you about all 27 of them: zkae.io Paper to appear at USENIX Security 2026: eprint.iacr.org/2026/058 Joint work with Matilda Backendal, Matteo Scarlata, Giovanni Torrisi
zkae.io
Zero Knowledge (About) Encryption
1110
Kenny Paterson @kennyog.bsky.social · 16/02/2026
In this "malicious server" threat model, we found a total of 27 vulnerabilities across Bitwarden, Dashlane, LastPass and 1Password. More than half of them lead to compromise of your passwords.
1111
Kenny Paterson @kennyog.bsky.social · 16/02/2026
Do you use a cloud-based password manager? So what's your threat model? Vendors like Bitwarden, Dashlane, LastPass and 1Password offer you "Zero Knowledge Encryption", with statements like: "Not even the team at Bitwarden can read your data (even if we wanted to)." We decided to test this… 1/n
23215
Kenny Paterson @kennyog.bsky.social · 12/02/2026
Miracle of miracles: Deutsche Bahn runs almost on time!
050
Kenny Paterson @kennyog.bsky.social · 11/02/2026
Almost in Karlsruhe for this talk. Looking forward to some great discussions with the KIT crypto and security community.
091
Reposted by Kenny Paterson
Kelsey Atherton @atherton.bsky.social · 23/01/2026
"The heroes of my fields have slain one of the four horsemen of the apocalypse, while the heroes of your field gathered in the desert to create a new one" is such a clear, brutal rebuttal to Manhattan Project mythology, and now the most venal idiots alive are bringing back diseases because they can.
xkcd.com
Degree-Off
06818
Kenny Paterson @kennyog.bsky.social · 20/01/2026
The sun still rises. And it will continue to do so. Long after the fascists are gone.
0141
Reposted by Kenny Paterson
Miro Haller @mirohaller.bsky.social · 19/01/2026
Submission week for the Cryptographic Application Workshop (CAW), an affiliated event at Eurocrypt'26 in Rome! Please submit your talk proposals on constructive real-world crypto using the following instructions before Jan 23, 2026 AoE. All infos on: caw.cryptanalysis.fun.
187
Reposted by Kenny Paterson
Parody Nigel Farage @parodypm.bsky.social · 13/01/2026
I insisted that Nadhim Zahawi delete this tweet before joining us, because one of our rules is that everyone in Reform UK has to pretend that I’m not racist.
11447134
Kenny Paterson @kennyog.bsky.social · 25/12/2025
Achievement unlocked: I finished the Private Eye Christmas cryptic crossword (#820). It’s a right corker, thanks to Cyclops for providing the much appreciated Yuletide mental gymnastics! @privateeyenews.bsky.social
030
Kenny Paterson @kennyog.bsky.social · 25/12/2025
Doubting Tomcat.
Cat sitting on a wall with a doubtful look on its face.
040
Kenny Paterson @kennyog.bsky.social · 19/12/2025
Some great talks to come at #RWC026 including 5 (!) from the Applied Cryptography research group @csateth.bsky.social on topics including Signal’s security, designing SecureDrop Next Generation, fuzzing of crypto libraries…. and one mystery topic still under embargo.
1225
Kenny Paterson @kennyog.bsky.social · 08/12/2025
Winter sun on Zuriberg.
0110
Kenny Paterson @kennyog.bsky.social · 18/09/2025
Nah, I just need more coffee!
010
Kenny Paterson @kennyog.bsky.social · 18/09/2025
When I read “was” I feared the worst. Glad to hear Alfred is alive and kicking (and still having impact).
100
Kenny Paterson @kennyog.bsky.social · 01/09/2025
Catching up on recent posts on the CFRG mailing list.
Two carved wooden heads on a Swiss bridge, both looking startled.
080
Kenny Paterson @kennyog.bsky.social · 02/08/2025
Good luck - hope everything goes smoothly and the course is a hit!
130
Kenny Paterson @kennyog.bsky.social · 28/07/2025
I like it! New mascot for the group.
000
Kenny Paterson @kennyog.bsky.social · 28/07/2025
Do I let this guy stay in the garage or gently remove him to a nice damp bit of garden?
450
Kenny Paterson @kennyog.bsky.social · 26/07/2025
Curve25519 is a false friend. Also isn’t it “defence” rather than “defense”? 🇬🇧
120
Kenny Paterson @kennyog.bsky.social · 18/07/2025
Would it be too salty to say how reassuring it is to find so many new experts in quantum computing and post quantum cryptography suddenly popping up over on LinkedIn?
0265
Kenny Paterson @kennyog.bsky.social · 17/07/2025
New reading material dropped.
0160
Reposted by Kenny Paterson
Real World Crypto Symposium @rwc.iacr.org · 13/07/2025
The Call for Contributed Talks is now open for RWC 2026! And the deadline for submissions is now Oct. 10, 2025. rwc.iacr.org/2026/contrib...
rwc.iacr.org
RWC 2026 call for papers
Real World Crypto Symposium
1129
Kenny Paterson @kennyog.bsky.social · 10/07/2025
Reading this gave me a lift - we are rapidly progressing to a carbon-free future, at least outside the US (who are being held back by extremist ideology and power of big oil lobbyists).
052
Kenny Paterson @kennyog.bsky.social · 09/07/2025
Wrong pole!
020
Kenny Paterson @kennyog.bsky.social · 09/07/2025
Hello again from mighty Svalbard, 78 degrees North, 125 days of constant sunlight.
2231