Security personnel around the world are on high alert following the discovery of eight TLS certificates with private keys so weak they could allow anyone to mint trusted browser and app credentials for any site on the Internet.
2 Boosts
0 Likes
“The private key sizes of the compromised keys ranged from 3 to 8 bits. Astonishingly, the private keys were 4, 56, 66, 115, 155, 156, 230, 237.” #fail
@dangoodin
Security personnel, my neighbor, their cat and yours truly you mean. I've been updating 6 Linux PC's, 3 raspberry PIs and 2 Windows computers and yet need to put a sticky note on my work laptop to update it first thing in the morning.
#4 (spelled #four) 4️⃣ 🧻 (this represents the certificate)
Edge users take note: Edge is the only major browser that has yet to block the certs. I asked Microsoft why this was and if it has plans to take action. The response: Microsoft will be in touch to let me know if it has anything to "share."
@dangoodin I just checked Edge, and it passed the Intermediate CA checks on the link from the article. It took a few moments before it updated.
Hi Veronica. What OS?
@dangoodin Ubuntu 26.04, and I did update ca-certificates first, so that may be it?
@dangoodin this would be really concerning if anybody used edge
@dangoodin I killed Edge at work today. Unrelated but it was behaving like a silly bugger too often.
@dangoodin Hmm.. this is an issue because of central certificate authorities, right? So Lets Encrypt or a self-signed certificate is unaffected.
Isn't this the issue with outsourcing the padlock checkbox to unknown "trusted" parties, so it's the same issue with any certificate authority?
Yes, we get the green padlock in our browsers, but really we have no idea who else got the keys from the certificate authority and so can read the traffic. Or am I misunderstanding?