Birbla

Join the discussion

Write your take first — we'll ask for email only when you're ready to publish.

Sign in
  • Hacker News
  • For all that DNSSEC is crap, DANE would at least mean that a domain is only vulnerable to failures of the authorities relevant to the domain.

    Meanwhile there are two less invasive changes that really ought to happen:

    1. A clean way for things like curl and Python to start checking CT logs like Chrome does.

    2. Name constraints. It’s long past time for the CAs of the world to have name constraints enforced. A CA that is not appropriate to use for .com should not work for .com. A CA that is not appropriate to use for .ae should not work for .ae. And the CA/B Forum should should requiring that all newly approved roots and all newly signed intermediates have appropriate name constraints.

    by amluto
  • Of COURSE it's easy to crack, 4 isn't even prime!
    by bombcar
  • "Importantly, none of the affected intermediate CAs were deployed in production, with the exception of one. Furthermore, none of these intermediate CAs, including the one deployed in production, have issued any end-entity certificates. This has been confirmed through our internal analysis and corroborated by publicly available Certificate Transparency records on crt.sh."

    This statement is more discerning than anything else. It raises question about why this certificates exists in first place if not deployed since 2025. Is it deliberate attempt to do compromising of system?

    In recent times, Indian Government is becoming quite rogue and don't follow the said procedures. So, it might be related to that as well.

    by gagan2020
  • Related: https://news.ycombinator.com/item?id=50166579

    “eMudhra intermediate CA compromise” | 947 points | 19 hours ago | 408 comments

    by WalterGR
  • Okay hear me out. People are complaining about unpatcheable IOT device and thats indeed concerning. But can’t we use the bad keys to generate seemingly value certificates that can be used to jailbreak these devices?

    EDIT: seems its already happening? https://x.com/otomir23/status/2112697830687047918

    by irusensei
  • > It's fortunate that the steps required here aren't particularly complicated for the devices you can update, and the advice essentially boils down to 'update them'. The problem is the devices you can't update or update easily.

    > Update everything that ships a CA bundle: your OS ca-certificates package, certifi, Node, Homebrew, and rebuild your container images once the base images pick up the change.

    > Devices you can't update are the hard part. Routers, printers, TVs, appliances with frozen firmware will trust these certificates until expiry, which is July 2039...

    Quick -- we need to MITM all the smart TVs so they can be jailbroken in one fell swoop!

    by jasonjayr
  • In retrospect, having 100 trusted certificate authorities might have been excessive.
    by jlmorton
  • new email from wayne, who is the original reporter:

    "I've had more than a few emails asking on how this was discovered. The simple answer is: https://github.com/google/paranoid_crypto

    Yeah, out of the box. CCADB was intended to be a quick corpus test before looking at subscriber certificates...

    I've done a far more thorough check of all existing CCADB certificates, thankfully no more hits. Most of my time has been spent going over the basics that everyone assumed someone else had already done - a critical mistake to ever make near security.

    So unless someone has significantly more computational resources or access to more cryptanalysis research the low-hanging fruit has been caught so far."

    https://groups.google.com/a/mozilla.org/g/dev-security-polic...

    by john_strinlai

Explore Birbla archives