When Giants Use Toothpicks
2025-07-03
Fireblocks is a digital asset custody platform, protecting trillions of dollars. During a security review at work I found how they protect their 4096-bit RSA 'disaster recovery' keys for customers with 2 rounds of MD5.
Following our responsible disclosure, Fireblocks has patched the issue.
The full technical breakdown and disclosure timeline is on our blog: When Giants Use Toothpicks
From the Blog
2026-11-03 Filen's password onion made me cry 
Filen hashes passwords with MD5(MD4(MD2(pwd))). This post shows several cryptographic weaknesses in their protocol and questions if it's even worth doing end-to-end encryption delivered through a webpage. 2026-10-02 Post-Quantum Crypto Won't Fix Your Architecture 
Adding PQC to this product was like installing a vault door on a tent. The server could intercept your keys and an RCE let attackers run code on your desktop. 2026-06-23 Proton's crypto is not Transparent and not OPAQUE 
Proton says privacy "isn't a promise, it's mathematically ensured." I found new ways they could read your data anyway.
Filen hashes passwords with MD5(MD4(MD2(pwd))). This post shows several cryptographic weaknesses in their protocol and questions if it's even worth doing end-to-end encryption delivered through a webpage. 2026-10-02 Post-Quantum Crypto Won't Fix Your Architecture Adding PQC to this product was like installing a vault door on a tent. The server could intercept your keys and an RCE let attackers run code on your desktop. 2026-06-23 Proton's crypto is not Transparent and not OPAQUE Proton says privacy "isn't a promise, it's mathematically ensured." I found new ways they could read your data anyway.