Post #2872961
2026-05-07 13:24 UTC
@DaveMWilburn@infosec.exchange @adulau@infosec.exchange gosh i have alot to say on this. first, "we" (back at the old place) tried to convince someone to go with constant length vectors vs daft delimited strings.
we also noodled (but never implemented) creating vector representations for each of the hashes (not just the TLS one). For reasons I can't blather abt off Signal, we didn't. It is a good idea tho, Dave.
There are def other issues. You brought up one (hash convergence b/c of tooling). 1/
Replies (1)
-
@hrbrmstr@mastodon.social 2026-05-07 13:27
@DaveMWilburn@infosec.exchange @adulau@infosec.exchange They end up being _an_ indicator, but even groups of them together rly shld be used with other attributes for any type of clustering IMO. Then there's the fact these are pretty much only good as hunt IoCs, not block or detect IoCs b/c too much is under attacker control, and publishing any set of JA4s in public tips them off and the good ones can and do tweak them (the problem is not as terrible as JA3, but it's up there). 2/