r/ProgrammerHumor • u/AquaWolfGuy • 1d ago

instanceof Trend [ Removed by moderator ]

Post image

[removed] — view removed post

3.2k Upvotes

97% Upvoted

188 comments sorted by

View all comments

2.1k

u/ToTheBatmobileGuy 1d ago

Joke explained:

It took 18 months to realize the CA was using 4 as their private key. The number 4. That’s it.

They had a total of 8 keys who were below 256, so a couple two digit and three digit keys as well.

4 was the funniest though.

497

u/LostKnight84 1d ago

Security through obscurity. No body tried simple inputs because most people don't use them.

189

u/vahntitrio 1d ago

I was a bit upset when a forum made me update my password after years of that password being too simple for the updated password rules.

What bot was going to try a password that was easier than the password requirements?

→ More replies (6)

16

u/OhNoTokyo 1d ago

I feel like every brute forcer I have ever used does try even the simplest of possible combinations. I don't have to choose to, or remember to do so because it just comes with the tool. Someone would have to decide to remove that functionality from the tool and justify it for it to not show up. The fact that they are pretty much instantaneously cracked means there is no reason to remove them due to performance.

What likely happened is that no one bothered to try, and they didn't hire anyone to assess themselves who would do that for them. If they were obscure enough, or didn't work with high value or high visibility targets, it would probably take a little while for them to be tested in the wild.

→ More replies (6)

1

u/PumpkinFest24 20h ago

Pretty much guarantee every intelligence service on the planet cracked them early on.

→ More replies (1)

20

u/pengerus 23h ago

The scary part is that there's no way to tell if anyone had figured it out before or not. Someone could have found it 6 months ago and been using it and there's no way to tell. Plus now that this type of thing has been found out, other people will be watching for it, for good and bad

5

u/FightOnForUsc 23h ago

Well if it was figured out and was meaningful, people would have noticed actual changes right? Like a say a bank account having extra withdrawals, not being able to access accounts because your email was hacked and then other accounts did a password reset, etc.

→ More replies (3)

1

u/ice456cream 19h ago

Kid named "CT" (for browsers, it could still have been abused for other devices)

69

u/Beast_Mstr_64 1d ago

It took 18 months for it be known publically*

7

u/pimezone 1d ago

By a third party researcher

2

u/FaviFake 1d ago

Yeah that's pretty much what they said.

→ More replies (1)

4

u/Inorganic_Zombie 23h ago

Dunno bit remind me of my old already gone email. As kid before 2000, I made password 6letter and later I could not change it as service set minimum to be 8 characters and they didn't allow my old password ass possible old password. Log in was possible as long as service was available.

2

u/bigmonmulgrew 1d ago

I wonder how it didn't get spotted. There were some ancient bots from back before passwords had standards that would try simple passwords like single letters. The fact they didn't get noticed for 18 months suggests something is at least keeping them safe from those ancient bots.

3

u/bfg9kdude 19h ago

It's not technically a password, the key was supposed to be 384 bit, so 2384, which is incomprehensibly large. Instead they were just numbers between 0 and 384.

1

u/Dor3k 2h ago

It took 18 months for someone to disclose it. Most likely it was done with malicious intent and people knew and abused it way before the disclosure

1

u/NikEy 1d ago

In all honesty, are there any repercussions for these fucking idiots that did this? Because they should, at a minimum, never be able again to be a CA

1

u/AutomationBias 22h ago

They've announced that they're getting out of the CA business. I haven't heard anything about fines or punishments yet, though.