4 ms·
He had signing keys for the Instagram app and the *.instagram.com keypair. Do you think that's not valuable and dangerous?
by chrissnell 6y ago
He had signing keys for the Instagram app and the *.instagram.com keypair. Do you think that's not valuable and dangerous?
- vuciv1 6y agosorry, can you explain what the signing keys and keypair would allow someone to do?
- dgrin91 6y agoWould allow you to make an app that steals all your info and release it as if it was the latest app from instagram.
- schrodinger 6y agoWouldn't you also need login info (prob including 2fa) to an Apple developer account?
- KMag 6y agoIf *.instagram.com keypair is the TLS certificate keypair, then they could MITM Instagram. They'd probably need to physically stalk some Instagram employees, but getting the TLS certificate key pair would be the difficult part. On a related note, what do MS Windows/OSX/Android/iOS/Linux do when they see a WiFi AP with an SSID (and maybe even MAC) they recognize, with a WPA2 key they know, operating without encryption? Will they still auto-connect in the clear? In other words, if an attacker cloned the SSID of someone's work/home network, with a strong enough signal, could they trick devices into auto-connecting to an unencrypted AP?
- benjaminberlin 6y agoPeople do this with public WiFi - for example, set up at Starbucks with a duplicated SSID, wait for target to connect and route it through as if it were connected to the real Starbucks WiFi, all the while monitoring in the middle.
- heavenlyblue 6y agoAnd what do they do with it? Set up a global worldwide network of agents extorting money from people sending dick pics over Instagram?