That has no effect, since the'd get no such business from now.
What's sad it they won't be taking their certs with them. Let's hope the powers up the chain conduct some deep self-refection on their part in thus fiasco.
> stop hoping corporations grow a soul and a conscience.
stop anthropomorphizing social constructs (corporations). corporations are run by humans. it is the humans running them that lack conscience and a soul.
They put the public key into js and encrypt the body of the request. This is common practice to protect users' important data from being accessed by a proxy (in this case, Cloudflare) and is ok.
But the real bug is that they don't rate-limit, invalidate, or protect the endpoint related to OTP checks, so it can be brute-forced, as the search space is limited.
I noticed that as well. Figured it was a concurrency issue, and they have a follow-up message that you can see if you click on the OP of the Mastodon thread that confirmed my guess: https://mastodon.catgirl.cloud/@49016/117476097901925573
>(yes the code is off by a few. its bc the poc is shit and to speed it up it uses 8 connections at the same time. it just stops the counter once it has a hit so its off by ~4 lmfao. you could easily fix this but cba today)
Only if they're lazy and went with the "download key and certificate (and we'll generate the keys for you)" option. Otherwise at least how it's supposed to work is that you give a CA a certificate signing request (CSR) containing your public key, they sign it and hand back your certificate. The certificate itself doesn't contain anything sensitive, because it's the same thing that your server presents to clients. But people are lazy and might not know how to generate a csr locally, hence the aforementioned option. And of course if they're too lazy to generate a csr locally, they're probably also too lazy to keep backups, so you can be sure that eMudhra keeps a copy in case they deleted it from their downloads folder.
I gave up cell phone service a few years ago (mid-sized USA city).
This seems less-and-less extreme, daily. Free yourselves from your leashes!
----
Next time you're standing in line, strike up conversation (about anything) with your ugliest linemate (it doesn't even matter about what, just offline communication)...
Maybe ya'll both like ZFS or "heard about that PHP thing!?" (I used both conversation starters, today – it worked – I can be the ugliest, too).
This site serves me garbage. Iocaine, I think? I use Brave.
"If you are not [a bot], and you feel you have been served garbage by mistake, please contact the owner of the site you're visiting."
If anyone knows another way to access the content, I'd be interested. No contact details are offered and visiting mastodon.catgirl.cloud resets my connection.
The anti AI scraping on this site doesn't work that well. I'm being served non-sense text about buttplugs. I'm human, I swear.
That was proof of soul check and you passed
anti-AI scraping is often anti-privacy in practice, as any effective implementation requires invasive browser inspection to detect scrapers.
That's what comes after the verification can.
that's actually the exploit, it was very physical
We're living in a South Park episode.
Oh man, good that they are leaving the CA business.
https://news.ycombinator.com/item?id=50195110
That has no effect, since the'd get no such business from now.
What's sad it they won't be taking their certs with them. Let's hope the powers up the chain conduct some deep self-refection on their part in thus fiasco.
> Let's hope the powers up the chain conduct some deep self-refection on their part in thus fiasco.
that almost never happens.
stop hoping corporations grow a soul and a conscience.
Who said anything about soul or conscience? Getting hacked doesn't deliver value for shareholders
> stop hoping corporations grow a soul and a conscience.
stop anthropomorphizing social constructs (corporations). corporations are run by humans. it is the humans running them that lack conscience and a soul.
In America, Corporations are people, too (for serious, see Citizens United SCOTUS ruling).
But corporately-suited Homo sapiens* should definitely be held criminally liable for much of their intentional shenanigans...
I understand it in the following way:
They put the public key into js and encrypt the body of the request. This is common practice to protect users' important data from being accessed by a proxy (in this case, Cloudflare) and is ok.
But the real bug is that they don't rate-limit, invalidate, or protect the endpoint related to OTP checks, so it can be brute-forced, as the search space is limited.
so not sure why the author shows us the public key
The number the tool found was 1861. The e-mailed OTP code was 1858. What am I missing?
I noticed that as well. Figured it was a concurrency issue, and they have a follow-up message that you can see if you click on the OP of the Mastodon thread that confirmed my guess: https://mastodon.catgirl.cloud/@49016/117476097901925573
>(yes the code is off by a few. its bc the poc is shit and to speed it up it uses 8 connections at the same time. it just stops the counter once it has a hit so its off by ~4 lmfao. you could easily fix this but cba today)
So basically anyone who used this CA is screwed if someone knows your email?
Only if they're lazy and went with the "download key and certificate (and we'll generate the keys for you)" option. Otherwise at least how it's supposed to work is that you give a CA a certificate signing request (CSR) containing your public key, they sign it and hand back your certificate. The certificate itself doesn't contain anything sensitive, because it's the same thing that your server presents to clients. But people are lazy and might not know how to generate a csr locally, hence the aforementioned option. And of course if they're too lazy to generate a csr locally, they're probably also too lazy to keep backups, so you can be sure that eMudhra keeps a copy in case they deleted it from their downloads folder.
With this exploit, what's stopping me from sending my own CSR for your domain?
Cut the undersea cables already
I gave up cell phone service a few years ago (mid-sized USA city).
This seems less-and-less extreme, daily. Free yourselves from your leashes!
----
Next time you're standing in line, strike up conversation (about anything) with your ugliest linemate (it doesn't even matter about what, just offline communication)...
Maybe ya'll both like ZFS or "heard about that PHP thing!?" (I used both conversation starters, today – it worked – I can be the ugliest, too).
Could someone explain this? Does this mean that it enables logging in as any account in emudhras infra?
Yes, it’s a complete auth bypass. All you need is the email address of a user and they’ll likely sign CSRs for any domains under that account.
It’s the end for them, I imagine.
Don't piss off the internet, there will be consequences. I guess.
Security represents less than 1% of their business.
Aye, but it'll now represent much, much more than 1% of their corporate reputation.
Purported security, you mean.
Actual security, add some zeros ;)
Damn, these Mastodon accounts are a rabbit hole to get lost in
Hahahahha what a roast. Too funny, especially the "4 Bars" in the background of the demo.
This site serves me garbage. Iocaine, I think? I use Brave.
"If you are not [a bot], and you feel you have been served garbage by mistake, please contact the owner of the site you're visiting."
If anyone knows another way to access the content, I'd be interested. No contact details are offered and visiting mastodon.catgirl.cloud resets my connection.
You can use https://github.com/jwilk/zygolophodon to read Mastodon posts in your terminal:
Doesn't that also fetch the content directly? So depending on the logic of the filter it likely won't make any difference.
It uses the API, which hopefully is protected from bots less fiercely.
https://archive.ph/Vnlt9
Ah yes, adopting the standard cloudflare approach. "Contact the site administrator to resolve this" but no contact details are provided.
"S" in "eMudhra stands for "Secure".
Please can this not be true..