24 ms·

Surely they would have to revoke all the keys anyway as they would have no idea if a blackhat got their first and took the keys before the vulnerability was rep

by Cakez0r 11y ago

Surely they would have to revoke all the keys anyway as they would have no idea if a blackhat got their first and took the keys before the vulnerability was reported?

bigiain 11y ago
According to the timeline, Instagram have known about the ssl keys since 1 Dec. My browser is currently showing an ssl cert for instagram.com that was issued in April and expires on Dec 31. Doesn't look like they're in any hurry to revoke that one. (I guess like Alex Stamos told his employer - it's "trivial and of little value"...)
- eropple 11y ago
  Or, like almost any company that's reasonably competent, they have multiple certificates with different private keys.
  - bigiain 11y ago
    And they just happen to only leave some of them in their S3 buckets? Seems … contradictory.