Top
Best
New

Posted by hkc 15 hours ago

Eight Bits of Trust: eMudhra's CA keys cracked in milliseconds(scotthelme.co.uk)
825 points | 393 commentspage 5
megous 11 hours ago|
Well, so what now? It's not like I have these in my system CA store, they're just intermediaries cross-signed by sectigo.
akdev1l 10 hours ago|
You can add the intermediate CA to your block list, presumably the distros will do this
megous 10 hours ago||
Looks like archlinux already did. After update my fake st*pe.com cert no longer verifies. Ufff.
Scott_Helme_ 9 hours ago||
The problem now becomes all of the things that can't be so easily updated.
dbcooper 14 hours ago||
All the numbers were under 384. Surely they couldn't have ...
MrDOS 14 hours ago|
All the numbers were under 256. Surely they did.
unsupp0rted 22 hours ago||
Never attribute to malice what can be explained by ignorance?

In this case I wonder if this was an intentional wide open doorway to fraud

MiroslavPokorny 21 hours ago|
This wasnt malice its was laziness.

They literally were too lazy to type more than just a single '4'.

unsupp0rted 19 hours ago|||
Either that or they intentionally wanted to create a publicly-accessible backdoor, with plausible deniability of laziness
yoyohello13 10 hours ago||
I love how this article explains multiplication... very carefully.
bandrami 12 hours ago||
Shakti de. This should be firm-ending for them but I fear it won't be.
alwa 23 hours ago||
Bugzilla bug in question:

https://.mozilla.org/showbug.cgi?id=2083449

LoganDark 22 hours ago|
https://bugzilla.mozilla.org/show_bug.cgi?id=2083449
kristofferR 7 hours ago||
This is amazing! I've already been able to grab firmware images for two locked down ESP32-using devices that I struggled to jailbreak before.
ligarota 12 hours ago||
Man in the middle just for the love of the game
siwatanejo 14 hours ago||
https://xkcd.com/221/
Qision 14 hours ago||
Literally the tutorial they used
Scott_Helme_ 11 hours ago||
I think this might be proprietary source code, did you get permission to share this?..
koolba 14 hours ago|
What the chances there’s another CA key out there with something like unix time as the key?
ls65536 12 hours ago|
Another place to search for private key candidates would be the outputs of various common PRNGs when they have been seeded with a timestamp (for all timestamps in, say, the past 20 years).

These would look like nice random values (unlike the ones that were recently compromised), but they would be trivial to generate by anyone who knows the initial inputs (PRNG algorithm, seed, maybe starting byte position, etc.).

More comments...