☭
4 is the new funny number. All other funny numbers are thereby declared obsolete.
@vaporeon_ I missed the context for this, why were you and someone else posting about 4?
but also, 4 is death https://en.wikipedia.org/wiki/Tetraphobia
@The_T Do you know about TLS certificates? They are used to encrypt a HTTPS connection, and also to prove that a web site really is the server it claims to be and not someone intercepting your connection and directing it somewhere else. But for that to work, ultimately you need to trust a Certificate Authority's certificates.
And some CA that I've never heard of before messed up and used 4 as the private key for one of those certificates (and very small numbers for the others).
And so now I, or anyone else, can create new certificates without anyone's approval and sign them as the CA who messed up, and pretend to be any web site
@The_T A private key should be a very big number that's basically impossible to guess
So it's inherently funny for it to be... 4
@The_T If you're now worried about whether you're affected, this is a web site (not mine) where you can test it: https://emudhra.we-have-a-problem.com/
@vaporeon_ I was aware of TLS certificates, but I've never understood how they worked. And your explanation about, requiring to trust a CA, makes sense, but then a mistake like this also seems... well, not inevitable, but unsurprising?
But yeah that is pretty funny
"if I'm affected" would only be if I had a website, right? or is it for websites I use? I think they'd have bigger problems, though...
@The_T Not only if you had a web site, if you connect to any web site, it's a bad problem
Imagine you connect to https://glaceon.social
glaceon.social sends to your browser a chain of certificates (if you're curious, in Firefox, you can click on the lock icon -> "Encrypted connection" -> "Details" -> "View certificate"), each certificate signed by the private key of the previous certificate. If e.g. glaceon.social's certificate is signed by Let's Encrypt, that means Let's Encrypt vouches for glaceon.social to really be who it claims to be, and then someone else signs Let's Encrypt's certificate, and so on, up to a root certificate that's stored in your browser and trusted unconditionally. The browser verifies this chain before establishing the connection to glaceon.social and sending them e.g. your password.
Now imagine Let's Encrypt's private key got leaked (it did not, another CA called "eMudhra" did, but that's just as bad because there's no limitation on which web site a CA can issue certificates for)
Then anyone could create a fake glaceon.social certificate, sign it with Let's Encrypt's private key, serve it on an evil web site pretending to be glaceon.social, and browsers would accept the fake certificate without complaining
The attacker would also need to intercept your connection first, which somewhat limits who can do this attack, but still, it is worth fixing ASAP if you're affected
@vaporeon_ mm, that makes sense.
Sounds like nothing I can do, though. 🤷
@The_T Do you use Firefox? In Firefox, you can manually revoke the compromised certificates so that your browser doesn't trust them anymore.
@vaporeon_ how would I know, though.
Like yeah, if I accidentally went to glaceoff.social, but
I'm at least vaguely aware I'm going to the site I intend to go to
@The_T The very problem with this is that even you typed correctly glaceon.social, an attacker who controls any computer on the path from your computer to glaceon.social (admittedly, that somewhat limits who can do this attack...), could intercept your connection and direct you to glaceoff.social and your browser wouldn't notice because glaceoff.social is faking glaceon.social's certificate
You could, in advance, revoke the trust in eMudhra's certificate that got compromised, so that any real or fake (it's impossible to distinguish at this point) certificates signed by it no longer are trusted by your browser, and so if an attacker directed you to glaceoff.social, the browser would give you an error message instead of connecting
@vaporeon_ yeah, but at that point I wouldn't know.
@The_T @vaporeon_ vaporeon is explaining to you what you can do so that you would know if it were to happen to you
@The_T @vaporeon_ if you remove the known compurromised root certificates then the browser won't trust certificates signed with them and will give you extremely loud warnings that something is bad and wrong
@aescling @vaporeon_ ohhh
how do I do that then
@aescling @vaporeon_ but also, in doing that; wouldn't that throw up an error on pages that are using the compromised ones, because they didn't catch up that it's compromised yet?
like, yeah, their fault and all, but
@vaporeon_ @aescling if they do fix their shit, will it re-import good ones, or would I have to go re-add them?
(context I have no idea how simple "fixing their shit" is)
@vaporeon_ @aescling one of the other ones on here is "Entrust, inc" which is a very on the nose name
@The_T @vaporeon_ there are no "good ones" to "re-import", the entire point is that certain certificate authorities are now known to be compromised and should be removed
ftr mozilla has a service they use to manage this exact kind of scenario fur users so you purrobably don't have to do anything, you can check at this section of the link vappy gave earlier; you want to see 0/12 connected
@aescling @vaporeon_ so they can never be trusted again? The internet will just have to abandon them and those sites will need to get (buy?) new certs?
@The_T @aescling In theory, I assume that they could make a new private key and give new certificates to all the web sites they had previously signed, and convince Mozilla etc. to add the new certificate to the list of trusted certificates
In practice, they messed up very badly, so I am not sure how much they will be trusted in the future
@The_T @vaporeon_ yes, exactly
thankfully, thanks to Let's Encrypt, certs can easily be obtained fur free these days. very, very quickly, too
@aescling @vaporeon_ true! Result: ✅ Did not connect
@The_T @aescling Ah, great, then you don't have to do anything
IIRC, Firefox has its own certificate store and updates can change it and they probably removed the compromised certificates in the latest update
I am just quite unwilling to update my Firefox because it seems that they add more bad things in every update... So I just manually revoked them without updating
@vaporeon_ @aescling oh sorry; to be clear, this was after I went in and deleted them, like you said to
@vaporeon_ @aescling thank you for this, fish friend and strange semi-multiple-cat friend
@vaporeon_ @aescling wow I have no idea how my brain made a mess of that toot the first time, I was thinking about the word "friend" and how to describe aesc and also have I mentioned I'm in constant mouth pain
@vaporeon_ @The_T @aescling I was also getting 0/12 when I checked earlier, I think Firefox might have been quick on the draw for this one
@amy @vaporeon_ @aescling oh okay neat
@vaporeon_ @The_T @aescling (Not that it's a bad idea to double check/make damn sure)
@amy @vaporeon_ @The_T mozilla have had a service to push certificate store updates without requiring updating firefox itself because of the severity of the issue. since 2015, apparently. so yeah they were quick on it
@vaporeon_ @amy @The_T i mean, "not receiving push updates from a proprietary service run by mozilla" sounds like decision librewolf would make to me
@vaporeon_ @amy @The_T apparently so that mozilla can control the certificates being used in the browser
@The_T @vaporeon_ if you don't have to deal with IT this can be done in seconds with Let's Encrypt, maybe a minute or two if you've never used it befur
if you have to deal with an IT department to get a decision made on this kind of thing.... oh boy.......
@The_T @aescling In Firefox? Go to about:preferences -> Privacy and security -> View certificates..., and that will open an interface where you can view all certificates and delete any that you want to
Specifically, the certificates by eMudhra and by Comodo (I am honestly not sure how Comodo is related to this, but the web site that reports this is advising to distrust the Comodo certificate, too...)
@vaporeon_ @The_T in non ESR firefox there's a submenu "Connection security" in Privacy and security, under "Certificates" click "Manage certificates"; by default it shows you certificate authorities, which is what you want here
@aescling @vaporeon_ what's ESR?
either way, I found it in my version
@The_T @vaporeon_ Extended Support Release, older version that is actively maintained, usually targeting organizations who don't want to have to worry about updating things constantly.
(it is also the version purrovided by debian (popular linux based OS, the basis of the even more popular Ubuntu) by default because their entire goal is system stability; packages only update (security updates aside) when the entire goddamn system does)
(it is not infrequently purrefurred by the kind of nerd who does not like recent changes to firefox. i only use stable because a particular extension i wanted to install required a later version than the current ESR)
@aescling @vaporeon_ I updated Firefox and then immediately went in and flicked the switch that made it look like the old version's theme
@aescling @vaporeon_ I'm too sleepy maybe, but I don't know how I'd know. If they set up a fake glaceon that looked like the real one, and also used it's certificate, how would I tell