Yeah, but it’s my Friday. It couldn’t wait until Monday? Eugh.
One thing I don’t understand…
So if a bad actor gets access to one of the intermediate CA certificates they can run all sorts of MITM attacks, right? What are the chances that government agencies don’t have a bunch of private keys from CA that are not obviously wrong? 0, right? So we should just assume that government agencies can do MITM whenever they want?
Cloudflare is the largest MITM hiding in plain sight.
It’s actually possible to prevent impersonation:
In theory all the generated keys are added to a public certificate transparancy log. Browsers should check that the key is there (but your http client library probably doesn’t - and this is why these compromised keys are a problem).
Website owners should also check that there are no other certificates in there, and if they see an extra misissued certificate something went really wrong at a CA and that CA would probably lose all the credibility and trust.
Also when you request a certificate the CA doesn’t get your private keys, so they can’t reuse your cert.
I wonder about one thing, if somebody can perform MITM on arbitrary domains, is there something like certificate pinning to stop impersonating the authorities used for things like this? I remember OCSP being something like that (if I’m not butchering the initialism), where the browser requests confirmation the certificate is currently valid, and the server can pre-fetch this confirmation to send to the client.
Yes, but if it’s not used for a website but VPN for example. If NSA got a private key from some compromised CA and did MITM on some VPN users, would anyone notice?
Man I miss tintin, ima go look for more memes
Your meme is already out of date.
GitLab just announced a CVSS 10.0 unauthenticated RCE: https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/
AGAIN?! That’s the third one in two months.
I’m tired of this grandpa
That’s too damn bad! You keep patching!
fuck
Uhhhhhh. Did you hear the news out of Wales?
A gov contractor left a user account called test2 with the password of Password1 in a prod system.
I give him credit for the one. I never would have guessed that by brute force.
Maybe a little cathartic brute force, then?
Ffs (boyo)
Including the AfD email leak, too?
Normal leak: This is does not spark joy.
AfD leak: This sparks joy.
Yeah, but that’s a good thing.
Oh for sure; just…. a lot of infosec news in general this week
In Chinese 4 sounds like death, and I think that’s beautiful.
Japanese too!
japanese 4 is just chinese 4 with extra steps
shi—
Cap’n its wednesday
France biggest Isp break 3/4 of it’s network
Yeah what the hell is happening here?
Ant info?
