3 ms·
Let’s see: Mercedes recently forgot a token in a public repository which grants access to everything. Microsoft forgot its “Golden Key” in the open, allowing
by bayindirh 3y ago
Let’s see:
Mercedes recently forgot a token in a public repository which grants access to everything.
Microsoft forgot its “Golden Key” in the open, allowing all kinds of activation and secure boot shenanigans.
Microsoft’s JWT private key is also stolen, making the login page a decoration.
Somebody stole Realtek’s driver signing keys for Stuxnet attack.
HDMI master key is broken.
BluRay master key is broken.
DVD CSS master key is broken.
TSA master keys are in all 3D printing repositories now.
Staying on the physical realm, somebody made an automated tool to profile, interpret and print key blanks for locks with "restricted keyways" which has no blanks available.
These are the ones I remember just top of my head.
So yes, any digital or physical secret key is secure until it isn’t.
It’s not a question of if, but when. So, no escrows or back doors. Thanks.
- wkat4242 3y agoI've been waiting for those wildvine keys to leak which would finally let me choose what to play my stuff on. But it still hasn't happened. They are getting better at secrecy sadly.
- bayindirh 3y agoSince Widevine L3 is completely implemented on software, there are tools you can use, but L2 and L1 are have hardware components, and secure enclaves are hard to break. Up to par ones have self-destruction mechanisms which trigger when you bugger them too much. On the other hand, there are 4K, 10bit HDR + multichannel versions everywhere, so there must be some secret sauce somewhere. This is not a rabbit hole I want to enter, though.
- piperswe 3y agoIt's apparently now trivial to brute force the private key used for Windows XP-era Microsoft Product Activation, as another example. (that's where UMSKT and the like get their private keys from)