How do I begin? Basically, an India based company that does TLS certification published some comically bad private keys. One of which was just the character 4. Update all of your browsers btw, desktop and mobile. This is a very major low level security breech of the entire internet.
It may take Linux distros days to patch it, and this includes millions of servers.
Firefox, likely Chrome, and maybe other major browsers update certificate revocations independently of the main app. Things are more complicated with various command-line apps and daemons, programming languages and libraries, which may require updates to system-wide packages or, worse, libraries for individual programs (ahem Python).
Also, private keys aren’t published, that’s their defining characteristic. Public keys are published, and of course they are used to check signatures made with particular private keys — in this case the ones generated by the security researcher.
How do I begin? Basically, an India based company that does TLS certification published some comically bad private keys. One of which was just the character 4. Update all of your browsers btw, desktop and mobile. This is a very major low level security breech of the entire internet.
It may take Linux distros days to patch it, and this includes millions of servers.
Firefox, likely Chrome, and maybe other major browsers update certificate revocations independently of the main app. Things are more complicated with various command-line apps and daemons, programming languages and libraries, which may require updates to system-wide packages or, worse, libraries for individual programs (ahem Python).
Also, private keys aren’t published, that’s their defining characteristic. Public keys are published, and of course they are used to check signatures made with particular private keys — in this case the ones generated by the security researcher.