| ▲ | hypfer 5 hours ago | ||||||||||||||||
From what the internet is telling me, the keys were allegedly found on https://repository.emsign.com/certs/<redacted>.crt Which, if true, is definitely a lot of fun. Hope you people are ready for lots and lots of suddenly hackable IoT. __ Edit: I might also be misinterpreting what I am seeing and it's actually weak logic that created the keys, in the sense that one could guess the private key? Someone actually qualified please give credible answers. I'm just pretending. | |||||||||||||||||
| ▲ | rollulus 3 hours ago | parent | next [-] | ||||||||||||||||
I think you’re right. And since the intermediate certs expire around 2039 and the private keys are known, we have plenty of smooth MitM fun against IoT in front of us. | |||||||||||||||||
| ▲ | baby_souffle 4 hours ago | parent | prev | next [-] | ||||||||||||||||
> Hope you people are ready for lots and lots of suddenly hackable IoT. I was not expecting to find a silver lining _this bright_ but you have a point. | |||||||||||||||||
| ▲ | oasisbob 5 hours ago | parent | prev | next [-] | ||||||||||||||||
Source? That would be an incredible blunder, but that also appears to be the kind of URL one would expect to find certs at. | |||||||||||||||||
| |||||||||||||||||
| ▲ | bombcar 5 hours ago | parent | prev | next [-] | ||||||||||||||||
That's actually a good point - tons of IoT is "secure enough" to sign things, but not secure enough to bother pinning anything ... Also who hasn't left their private keys hanging around web-accessible, eh? lol | |||||||||||||||||
| ▲ | q3k 4 hours ago | parent | prev | next [-] | ||||||||||||||||
https://chaos.social/@fluepke/117474156947559280 Private keys can be trivially recovered from the public keys because they're tiny. I found D=156, flüpke found D=4. Yes, that's the entire private key. | |||||||||||||||||
| |||||||||||||||||
| ▲ | 5 hours ago | parent | prev [-] | ||||||||||||||||
| [deleted] | |||||||||||||||||