Comment on "You guys are stupid, they're gonna be looking for 256 bit security keys."

snoons@lemmy.ca ⁨8⁩ ⁨hours⁩ ago

• mkwt@lemmy.world ⁨8⁩ ⁨hours⁩ ago

  It’s a different thingymajigger.

  One of the orgs that does TLS infrastructure was found to have used 4, a number from Sesame Street, as a private key on a TLS cert that was used to sign other certs.

  source

  • marcos@lemmy.world ⁨8⁩ ⁨hours⁩ ago

    Just to add. Those private keys are a 85 to 170 digits random number.

    A very central company whose security the entire internet depends on picked 00000000000…0000004.

    source

    • 4am@lemmy.zip ⁨5⁩ ⁨hours⁩ ago

      I can’t tell if it’s like, completely awful or kind of awesome. I mean, no one brute-forces private key space one bit at a time, do they?

      Hey America’s nuclear launch code was eight zeros (“00000000”) at some point in the 1960s; technically we’ve survived worse

      source

      • 0x0@lemmy.dbzer0.com ⁨5⁩ ⁨hours⁩ ago

        Almost assuredly someone is brute forcing all single-byte keys. In fact the private key equal to 4 is a single-bit, or “one hot” key, so an attacker could have found it by brute-forcing 384 different keys 😂

        source
      • Tehhund@lemmy.world ⁨4⁩ ⁨hours⁩ ago

        I originally thought nobody would try brute forcing simple keys like this, but then the person who found the vulnerability did it so I bet other people have done it. It’s less “gee hope this works” and more “If someone screwed up there key generation this might work,” and screwing up key generation is a known problem. Rare, but it does happen as this case demonstrates.

        source
  • CainTheLongshot@lemmy.world ⁨3⁩ ⁨hours⁩ ago

    Psychostick - I Can Only Count To For

    source
• Hudell@lemmy.dbzer0.com ⁨8⁩ ⁨hours⁩ ago

  Imagine a big stamp. Anything stamped with it, the internet in general trusts. Because we all trust that nobody knows how to stamp things like that big stamp. Except instead of a literal stamp, it’s a secret combination of numbers and letters that works like a password. It now turns out that this secret combination of numbers and letters was just the number 4.

  source

  • panda_abyss@lemmy.ca ⁨8⁩ ⁨hours⁩ ago

    My favourite analogy on this is that they had a master key with 398 slots for bumps, and they decided to only use one notch/bump for the whole thing.

    You can’t open that with most regular keys, but if you try the most basic of picking you’ll find it pretty quick.

    source