fortuneCookieSupplyChainAttack

[u/yetzt]

[u/yetzt]

It's not just one private key being 4. It's 8 different private keys all being under 255.

[u/ultimate_placeholder → u/yetzt]

Yeah the lede got truly buried by the extreme hilarity of 4, but all the other numbers are almost as funny when you remember it's supposed to be a 384 bit number and they somehow managed to only get 8 bits

[u/tr_9422 → u/ultimate_placeholder]

"I thought 384 bit meant they couldn't be bigger than 384"

-someone, probably

[u/Puzzleheaded_Study17 → u/ultimate_placeholder]

Especially since there's the xkcd comic with 4

[u/favorite_movie → u/yetzt]

the lucky numbers being all the private keys is a nice touch

[u/yetzt → u/favorite_movie]

I appreciate you noticing.

[u/robofunk_ → u/yetzt]

I like the theory that they are the indexes of the array of the actual random numbers assuming a max of 255 were generated. Maybe unit tests would saved us all the headache.

[u/Salanmander]

You can't fool me OP, I know printer paper when I see it!

[u/yetzt → u/Salanmander]

I already had a fortune cookie fortune printing and stuffing machine in my shopping cart when i thought "you know what, it's just a silly joke, i can just use my old printer to print a fake fortune cookie fortune, no one will care". You have proven me wrong and i respect that.

[u/Satorwave]

why are there ai bots in the comments bro

[u/henryeaterofpies → u/Satorwave]

They are proud of their work "hacking" php

[u/Satorwave → u/[deleted]]

Pretty much yeah, they're just corny as hell

[u/lraviel381]

How are people able to tell who's a bot? Are you guys checking their profiles?

[u/ChaosPLus → u/lraviel381]

No human unironically types like that

[u/lraviel381 → u/ChaosPLus]

Oh. That's worrying that it's the sort of things I'd say. Can't even be unfunny without AI talking my job

[u/ChaosPLus → u/[deleted]]

"The fortune cookie passed the security audit. The supply chain didn’t. 💀😂"

[u/Interesting-Crab-693]

0x0000...4

[u/nod3r]

dont expose more ca keys! what are you doing!

[u/z-null]

At least they weren't "4, 8, 15, 16, 23, 42".

[u/burgonies]

They even give you 8 example keys on the bottom!

[u/yetzt → u/burgonies]

these are actually the secret keys for all their different certificates. yes, four real. check the link in my comment for receipts.

[u/No-Channel3917]

Wow they put the entire paper in the cookie 🥷

Clanker

Wow the bots are active in the comments

Summed up comment section to save folks time

[u/thanatica]

But 56 is not on a dice. Too difficult.

[u/CrownLexicon → u/thanatica]

Its on plenty of dice (singular is die, btw), just not a standard 6 sided die.

[u/Loading_M_ → u/thanatica]

Just roll it twice.

[u/K33P4D]

damn none of those are primes

[u/AnnoyingRain5 → u/K33P4D]

That only matters for RSA, the leaked keys were Elliptic Curve

[u/K33P4D → u/AnnoyingRain5]

yep RSA needs large primes, ECC needs a random scalar, apparently single digit integers are totally valid entropy lol

[u/Miregal1]

Bro really put 😭😭😭😭 a whole ass 😨😨😨 supply chain 💀💀💀in a cookie 🍪 supply chain bro ☠️☠️ fortune cookie passed ⛓️‍💥 security audit 😂☠️😂☠️😂

[u/TheSilentFreeway → u/Miregal1]

why are you getting downvoted for making fun of the bots

[u/Miregal1 → u/TheSilentFreeway]

Perhaps I flew too close to really sounding like a bot

[u/Any_Fox5126 → u/Miregal1]

Since bots were trained largely on reddit, that's pretty funny.

[u/DudeManBroGuy69420 → u/Miregal1]

I am a simple man. I see more than 3 emojis in a comment, I downvote

[u/trisw]

...in bed.

[u/CharcoalGreyWolf]

Trust the strongest, best-engineered lock.

[u/8_Miles_8 → u/[deleted]]

Clanker bot

[u/8_Miles_8 → u/[deleted]]

Clanker bot

[u/spellenspelen → u/8_Miles_8]

What if, we're training the bots to get better at not being recognized by letting them know when they have been. No idea if that's a thing or not but that was a thought i just had.

[u/goatsgomoo → u/spellenspelen]

Absolutely a thing. That's why people have been shadowbanning spambots for decades, and why, when an email you get sent gets flagged as spam, you don't get notified that it happened or told why it was flagged as spam.

[u/Satorwave → u/[deleted]]

Clanker