2 ms·
> When Rowley asked for proof the certificates were compromised, the Trustico CEO emailed the private keys of 23,000 certificates Voilà, compromised certs! Co
by linkmotif 9y ago
> When Rowley asked for proof the certificates were compromised, the Trustico CEO emailed the private keys of 23,000 certificates
Voilà, compromised certs!
Couldn’t tell if that was supposed to be the idea. But amusing nonetheless.
- Bartweiss 9y agoI can't tell if the logic was "we shouldn't have these keys so the certs are blown" or "watch, I just compromised the certs!" Either way, it's very much a case of "my neighborhood isn't safe - because I keep committing crimes there." edit: Oh, reading the Mozilla page it's also "we allowed code injection on the cert generation page". That's even worse.
- pilif 9y agoAlso, that script was running as root https://mobile.twitter.com/taviso/status/969230138956136448 https://mobile.twitter.com/taviso/status/969230138956136448
- Bartweiss 9y agoHah, seriously? ...I wonder whether the keys would have been more or less safe if, instead of all that, they just uploaded them unsecured to Pastebin. At least then they might have gone unnoticed, instead of being handed straight to possible bad actors.