Intermediate certs allow anyone to mint web credentials for any Internet server.

Astonishingly, the private keys were 4, 56, 66, 115, 155, 156, 230, 237.

exploiting compromised certificates requires an active adversary-in-the-middle attack, meaning the attacker must act as a proxy between two TLS parties and receive encrypted traffic, decrypt it, reencrypt it, and send it to the other party. Such capabilities, in some cases, are usually limited to only the most well-resourced attackers. People with control of a local network—at a coffee shop, university, or other organization—face much less of a challenge.

https://emudhra.we-have-a-problem.com/

Xkcd 221: int getRandomNumber() { return 4; // chosen by fair dice roll. guaranteed to be random. }

  • BluescreenOfDeath@lemmy.worldEnglish
    2·
    11 hours ago

    That’s… what I said?

    I do consider this a threat. A root certificate being compromised is a big deal. Your web traffic goes across multiple devices before reaching its intended destination, and if any one of them are compromised they could successfully perform an invisible man in the middle attack of your browser/app keeps trusting those certificates.

    • KeenFlame@feddit.nuEnglish
      1·
      10 hours ago

      Ssl is pretty useful, yeah, but those that were mass unlocked with a gimmick key were already very insecure and at this moment they are revoked. Either way, aren’t you supposed to be locked in now?

      • BluescreenOfDeath@lemmy.worldEnglish
        1·
        9 hours ago

        That only applies to applications and services that support remote certificate revocation.

        Those certificates were still in use until Firefox offered another update this morning, but that’s just the browser. Every company and their little bastard love child wants you to use an app to connect to their services, how many of those apps support automatic certificate revocation?

        Any app on your phone that doesn’t is now vulnerable to being compromised invisibly. A successful MITM attack looks like nothing at all. The attacker decrypts the traffic with the compromised certificate’s secret to snoop in on the secrets (like username and password) and re-encrypts it to send it forward so the destination server doesn’t know any different either.

        Now that it’s public knowledge, I guarantee someone is trying to capitalize on it right now.

        How certain are you that not a single switch between you and your bank’s website is fully secured?