5 ms·

When a company says "we're not changing our potentially compromised keys because we're protected by this magic box" and you punch a million holes in the magic b

by daeken 13y ago

When a company says "we're not changing our potentially compromised keys because we're protected by this magic box" and you punch a million holes in the magic box, your goal should be to make it well known that the protection is faulty. He accomplished that quickly, and now they're finally doing the right thing.

deleted 13y ago
[deleted]
brians 13y ago
We're not doing anything we wouldn't have done in response to mail to security@akamai.com encrypted to pub 4096R/5B9283CE 2007-04-04 [expires: 2017-04-01] Key fingerprint = 4A76 FD9B 3603 C9F5 33F8 1490 49E0 5C45 5B92 83CE uid Akamai Security Team (General Public) <security@akamai.com> sub 2048R/DF985919 2013-03-29 [expires: 2015-03-29]
- daeken 13y ago
  If the Heartbleed bug was still viable against your service, I'd say that he made the wrong call and should've emailed your team about it. But here, we're basically talking forensics. I've written at length about the decision to not roll the keys as soon as Heartbleed was discovered, so I won't repeat myself, but in short: him publicizing this, as well as the Cloudflare challenge immediately getting slapped down, should make it clear to everyone that if you have a memory read, you should assume everything is compromised. Hopefully this is a good thing for security in general.
  - brians 13y ago
    There I agree with you. Thanks.
    - daeken 13y ago
      For what it's worth, I think that the patch you guys threw out there (and have been using for a while) is a great idea, and I really hope it ends up in mainline OpenSSL. I think you guys have acted 100% properly from a tech perspective in this whole thing, even if a bug did pop up (when do they not?). I disagree strongly with the business decision made w.r.t. keys, but I hope people don't take that as me ragging on the tech team over there; you guys are doing good work.
      - anonymouse01 13y ago
        How do you know the business team didn't ask the tech team: "Should we rotate all the keys?" And someone said: "Nope, we wrote this awesome custom allocator in 2001, all good!". FWIW, we're still waiting for our cert to be reissued by Akamai. It's only been 6 days since everyone else reissued their certs. Great job team!

by daeken 13y ago

deleted 13y ago

[deleted]

brians 13y ago

We're not doing anything we wouldn't have done in response to mail to security@akamai.com encrypted to pub 4096R/5B9283CE 2007-04-04 [expires: 2017-04-01] Key fingerprint = 4A76 FD9B 3603 C9F5 33F8 1490 49E0 5C45 5B92 83CE uid Akamai Security Team (General Public) <security@akamai.com> sub 2048R/DF985919 2013-03-29 [expires: 2015-03-29]

daeken 13y ago
If the Heartbleed bug was still viable against your service, I'd say that he made the wrong call and should've emailed your team about it. But here, we're basically talking forensics. I've written at length about the decision to not roll the keys as soon as Heartbleed was discovered, so I won't repeat myself, but in short: him publicizing this, as well as the Cloudflare challenge immediately getting slapped down, should make it clear to everyone that if you have a memory read, you should assume everything is compromised. Hopefully this is a good thing for security in general.
- brians 13y ago
  There I agree with you. Thanks.
  - daeken 13y ago
    For what it's worth, I think that the patch you guys threw out there (and have been using for a while) is a great idea, and I really hope it ends up in mainline OpenSSL. I think you guys have acted 100% properly from a tech perspective in this whole thing, even if a bug did pop up (when do they not?). I disagree strongly with the business decision made w.r.t. keys, but I hope people don't take that as me ragging on the tech team over there; you guys are doing good work.
    - anonymouse01 13y ago
      How do you know the business team didn't ask the tech team: "Should we rotate all the keys?" And someone said: "Nope, we wrote this awesome custom allocator in 2001, all good!". FWIW, we're still waiting for our cert to be reissued by Akamai. It's only been 6 days since everyone else reissued their certs. Great job team!