Google QUIC is vulnerable to cyber criminal activity, creates a ‘black hole’ that hackers can exploit.

[Karla Sleutel]

23 hours ago, Sampei.Nihira said:

Unfortunately, MSQUIC is also supported by recent operating systems.

MsQuic is supported on "Operating system: Windows 11 and later"

https://en.wikipedia.org/wiki/MsQuic

 

[D.Draker]

On 4/2/2024 at 6:17 PM, NotHereToPlayGames said:

Perhaps it's your ISP?

ISP has nothing to do with it.

QUIC works through UDP, ISP won't block UDP for obvious reasons.

[D.Draker]

On 4/3/2024 at 4:17 PM, Karla Sleutel said:

MsQuic is supported on "Operating system: Windows 11 and later"

https://en.wikipedia.org/wiki/MsQuic

 

I'm just guessing. Probably they also added the support in the latest Win 10 updates? Though, no precise info about it.

Anyways, it won't matter since Chrome itself supports QUIC for a t least several years.

[Saxon]

Another reason to avoid QUIC.

https://msfn.org/board/topic/186119-youtube-stutter-in-edge-fix-disable-quic-protocol/

[j7n]

I've been disabling QUIC in all my browsers because it is a Google format and  I don't like the concept of the server deciding what resources to push, and more excuses to cram more overhead into webpages because they are quick enough. Is this quantum thing a threat to old browsers because basic HTTP/1 is on its way out?

[D.Draker]

4 hours ago, j7n said:

I've been disabling QUIC in all my browsers because it is a Google format and  I don't like the concept of the server deciding what resources to push, and more excuses to cram more overhead into webpages because they are quick enough. 

You're indeed right!

4 hours ago, j7n said:

 Is this quantum thing a threat to old browsers because basic HTTP/1 is on its way out?

It very well can be, seeing they already call it HTTP/3, I still hope it won't happen very soon because the format is flawed.

[D.Draker]

4 hours ago, j7n said:

Is this quantum thing

In case you missed, Hybrid Post Quantum Key + QUIC (Kyber draft "X25519Kyber768Draft00"),  instructions on bruteforcing that weak "encryption" method.

https://msfn.org/board/topic/186176-x25519kyber768draft00-hybrid-post-quantum-secure-key/?do=findComment&comment=1265284

[NotHereToPlayGames]

19 minutes ago, D.Draker said:

I still hope it won't happen very soon because the format is flawed.

As are SSL "certificates".  But I digress.

[D.Draker]

On 5/6/2024 at 8:22 PM, NotHereToPlayGames said:

As are SSL "certificates".  But I digress.

Excuse me, I don't like "everyone is bad approach". A specific matter is being discussed, and it's not about SSL, why? Because it doesn't aim to replace 'em! It (QUIC) aims to replace http/2 connections.

[D.Draker]

On 5/6/2024 at 8:22 PM, NotHereToPlayGames said:

As are SSL "certificates".  But I digress.

On second thought, talk is cheap, and if you still insist, please provide with precise instructions, like I did with the hacking of Kyber.

https://blog.quarkslab.com/sandboxaq-ctf-2024.html

[D.Draker]

On 5/6/2024 at 6:08 PM, j7n said:

I've been disabling QUIC in all my browsers

Don't forget to vote. Thanks.

https://msfn.org/board/topic/186094-google-quic-is-vulnerable-to-cyber-criminal-activity-creates-a-‘black-hole’-that-hackers-can-exploit/