new email from wayne, who is the original reporter:

"I've had more than a few emails asking on how this was discovered. The simple answer is: https://github.com/google/paranoid_crypto

Yeah, out of the box. CCADB was intended to be a quick corpus test before looking at subscriber certificates...

I've done a far more thorough check of all existing CCADB certificates, thankfully no more hits. Most of my time has been spent going over the basics that everyone assumed someone else had already done - a critical mistake to ever make near security.

So unless someone has significantly more computational resources or access to more cryptanalysis research the low-hanging fruit has been caught so far."

https://groups.google.com/a/mozilla.org/g/dev-security-polic...

▲

TheJoeMan 2 hours ago | parent | next [-]

I must say, if I was writing a password cracker, I probably would not think to actually start at "1".

	▲	unrented7977 2 hours ago \| parent [-]
		Security through incredulity

▲

renhanxue 4 hours ago | parent | prev | next [-]

> https://github.com/google/paranoid_crypto

This repository was archived by the owner on Aug 19, 2026. It is now read-only.

I guess now that we've checked, nobody will ever make a mistake like this again so we don't need this anymore? :)

	▲	wildzzz 2 hours ago \| parent \| next [-]
		Archive is a nice solution in between just letting it rot on the vine forever and deleting it. Leaving it open doesn't immediately signal to users that the codebase is no longer in development, youd have to check when the last commit was. And even then, that doesn't tell you much. Is this so simple of an app that there's really nothing to patch or upgrade for long periods? A python script that converts some legacy file format into an open one might effectively be complete, there's nothing left to add or fix and there's no real threat vector to exploit. Or is this a cutting edge app that someone committed daily for years but now hasn't moved in a year. The one thing I don't like about archive is the inability to add new issues. If I encounter a new issue, I don't necessarily want to fork it and track the new issue myself. I don't want to take responsibility for the code, I just want to let people know so someone else can fix it if they care.
	▲	Aurornis 4 hours ago \| parent \| prev \| next [-]
		Archived means it’s still available but signals that it won’t be developed. Last commit was 2 years ago anyway.
	▲	fortran77 4 hours ago \| parent \| prev [-]
		You can still use a read-only archive.

▲

commandersaki 2 hours ago | parent | prev | next [-]

I'm guessing this is the code:

https://github.com/google/paranoid_crypto/blob/main/paranoid...

▲

Scott_Helme_ 4 hours ago | parent | prev [-]

I have to be honest, that hasn't stopped me from trying!