Rendered at 14:50:38 GMT+0000 (Coordinated Universal Time) with Cloudflare Workers.
ignatella 2 days ago [-]
I understand it in the following way:
They put the public key into js and encrypt the body of the request. This is common practice to protect users' important data from being accessed by a proxy (in this case, Cloudflare) and is ok.
But the real bug is that they don't rate-limit, invalidate, or protect the endpoint related to OTP checks, so it can be brute-forced, as the search space is limited.
ignatella 2 days ago [-]
so not sure why the author shows us the public key
jttnr 2 days ago [-]
Oh man, good that they are leaving the CA business.
That has no effect, since the'd get no such business from now.
What's sad it they won't be taking their certs with them. Let's hope the powers up the chain conduct some deep self-refection on their part in thus fiasco.
dualvariable 2 days ago [-]
> Let's hope the powers up the chain conduct some deep self-refection on their part in thus fiasco.
that almost never happens.
stop hoping corporations grow a soul and a conscience.
Georgelemental 2 days ago [-]
Who said anything about soul or conscience? Getting hacked doesn't deliver value for shareholders
greenavocado 2 days ago [-]
> stop hoping corporations grow a soul and a conscience.
stop anthropomorphizing social constructs (corporations). corporations are run by humans. it is the humans running them that lack conscience and a soul.
ProllyInfamous 2 days ago [-]
In America, Corporations are people, too (for serious, see Citizens United SCOTUS ruling).
But corporately-suited
Homo sapiens* should definitely be held criminally liable for much of their intentional shenanigans...
So basically anyone who used this CA is screwed if someone knows your email?
gruez 2 days ago [-]
Only if they're lazy and went with the "download key and certificate (and we'll generate the keys for you)" option. Otherwise at least how it's supposed to work is that you give a CA a certificate signing request (CSR) containing your public key, they sign it and hand back your certificate. The certificate itself doesn't contain anything sensitive, because it's the same thing that your server presents to clients. But people are lazy and might not know how to generate a csr locally, hence the aforementioned option. And of course if they're too lazy to generate a csr locally, they're probably also too lazy to keep backups, so you can be sure that eMudhra keeps a copy in case they deleted it from their downloads folder.
pdpi 2 days ago [-]
With this exploit, what's stopping me from sending my own CSR for your domain?
hoherd 2 days ago [-]
The number the tool found was 1861. The e-mailed OTP code was 1858. What am I missing?
molticrystal 2 days ago [-]
I noticed that as well. Figured it was a concurrency issue, and they have a follow-up message that you can see if you click on the OP of the Mastodon thread that confirmed my guess: https://mastodon.catgirl.cloud/@49016/117476097901925573
>(yes the code is off by a few. its bc the poc is shit and to speed it up it uses 8 connections at the same time. it just stops the counter once it has a hit so its off by ~4 lmfao. you could easily fix this but cba today)
TazeTSchnitzel 22 hours ago [-]
Does anyone understand what's going on here? They expect some kind of request to be signed with a certain key, but what is that request and what does it get you?
vbezhenar 22 hours ago [-]
I guess they just bruteforce OTP by sending all combinations of four digits to the server and eventually one works.
tommica 2 days ago [-]
Could someone explain this? Does this mean that it enables logging in as any account in emudhras infra?
cyberpunk 2 days ago [-]
Yes, it’s a complete auth bypass. All you need is the email address of a user and they’ll likely sign CSRs for any domains under that account.
It’s the end for them, I imagine.
vinckr 22 hours ago [-]
I'm getting blocked or rather served nonsense because the site thinks I'm an AI scraper :/
I guess this is normal now
antonvs 22 hours ago [-]
It worked for me just now, and I'm on mobile internet which gets blocked more often than landline connections.
_ache_ 22 hours ago [-]
eMudhra may be exiting the global SSL/TLS certificate business, but that won't fix its security culture. It's not even 2FA, it's 1FA.
antonvs 22 hours ago [-]
If anyone can guess or brute force the factor, it's approaching 0FA.
It's like fractals, not all dimensions are integers. If your one factor is extremely weak, then it's really only 0.x of a factor.
FLeXMurphy 2 days ago [-]
Security represents less than 1% of their business.
lenerdenator 2 days ago [-]
Aye, but it'll now represent much, much more than 1% of their corporate reputation.
chrisjj 2 days ago [-]
Purported security, you mean.
Actual security, add some zeros ;)
skeledrew 2 days ago [-]
I guess certs isn't the only thing they'll be exiting.
cyberpunk 2 days ago [-]
Don't piss off the internet, there will be consequences. I guess.
tossit444 22 hours ago [-]
Blocked link, thanks AI!
gilrain 2 days ago [-]
This site serves me garbage. Iocaine, I think? I use Brave.
"If you are not [a bot], and you feel you have been served garbage by mistake, please contact the owner of the site you're visiting."
If anyone knows another way to access the content, I'd be interested. No contact details are offered and visiting mastodon.catgirl.cloud resets my connection.
Ah yes, adopting the standard cloudflare approach. "Contact the site administrator to resolve this" but no contact details are provided.
VladVladikoff 2 days ago [-]
Hahahahha what a roast. Too funny, especially the "4 Bars" in the background of the demo.
trallnag 2 days ago [-]
Damn, these Mastodon accounts are a rabbit hole to get lost in
baal80spam 2 days ago [-]
"S" in "eMudhra stands for "Secure".
EQYV 2 days ago [-]
Please can this not be true..
bragr 2 days ago [-]
The anti AI scraping on this site doesn't work that well. I'm being served non-sense text about buttplugs. I'm human, I swear.
Muromec 2 days ago [-]
That was proof of soul check and you passed
evulhotdog 1 days ago [-]
I got the same, on a residential internet service. No idea what the trigger is, worked on my phone though.
ronsor 2 days ago [-]
anti-AI scraping is often anti-privacy in practice, as any effective implementation requires invasive browser inspection to detect scrapers.
esseph 2 days ago [-]
The web is for bots now. Humans are the minority and will get pushed out, or leave in the face of various pending identity verification schemes to get past the bot filters.
skeledrew 2 days ago [-]
The web was always intended for both humans and machines.
Never thought I'd miss the days when block(chain)heads thought they had the rights to the term Web 3.0.
esseph 1 days ago [-]
Identity verification will gate the web due to various political and legal pressures. Anonymity will only be found outside it.
doubled112 2 days ago [-]
That's what comes after the verification can.
paimapi 2 days ago [-]
that's actually the exploit, it was very physical
nathancahill 2 days ago [-]
We're living in a South Park episode.
bigfishrunning 2 days ago [-]
[flagged]
BigTTYGothGF 2 days ago [-]
Coward.
_def 2 days ago [-]
You should be able to open the url in any other mastodon instance where you are signed in
bigfishrunning 2 days ago [-]
did not know it was a mastodon thing
codeduck 2 days ago [-]
so use your phone?
sgsjchs 2 days ago [-]
weak aura
OptionOfT 2 days ago [-]
There was an post about something like this a while back on lobste.rs, where some people were upset about the image that Anubis shows while it is validating your machine.
_def 2 days ago [-]
People are so uptight, it's embarassing
CodinM 2 days ago [-]
I mean, they do accept money to give you a version without that.
greenavocado 2 days ago [-]
Cut the undersea cables already
ProllyInfamous 2 days ago [-]
I gave up cell phone service a few years ago (mid-sized USA city).
This seems less-and-less extreme, daily. Free yourselves from your leashes!
----
Next time you're standing in line, strike up conversation (about anything) with your ugliest linemate (it doesn't even matter about what, just offline communication)...
Maybe ya'll both like ZFS or "heard about that PHP thing!?" (I used both conversation starters, today – it worked – I can be the ugliest, too).
danielbln 2 days ago [-]
Please don't, not everyone appreciates small talk.
ProllyInfamous 1 days ago [-]
Please express this succinctly when talkers like me "get going" – I appreciate that not everybody wants these brief connections (you won't hurt my feelings with a simple "hey I'm not really much for talking").
If you prefer wordless silence, pulling out a phone (or book/magazine) works well when talkers "don't take the hint;" or face away (for particularly invasive conversation starters).
My hope is that small talk leads to shared connections, perhaps even (a brief intertwining of) humanity.
majorchord 6 hours ago [-]
So everyone else should suffer because you don't want to politely decline?
danielbln 5 hours ago [-]
Suffer? Where's that rugged individualism when you need it.
Sphax 22 hours ago [-]
Is this site blocking users coming from HN or something ? I'm getting a garbage page starting with "Face, those cold eyes, and the pale people; I like them if we have."
They put the public key into js and encrypt the body of the request. This is common practice to protect users' important data from being accessed by a proxy (in this case, Cloudflare) and is ok.
But the real bug is that they don't rate-limit, invalidate, or protect the endpoint related to OTP checks, so it can be brute-forced, as the search space is limited.
https://news.ycombinator.com/item?id=50195110
What's sad it they won't be taking their certs with them. Let's hope the powers up the chain conduct some deep self-refection on their part in thus fiasco.
that almost never happens.
stop hoping corporations grow a soul and a conscience.
stop anthropomorphizing social constructs (corporations). corporations are run by humans. it is the humans running them that lack conscience and a soul.
But corporately-suited
Homo sapiens* should definitely be held criminally liable for much of their intentional shenanigans...>(yes the code is off by a few. its bc the poc is shit and to speed it up it uses 8 connections at the same time. it just stops the counter once it has a hit so its off by ~4 lmfao. you could easily fix this but cba today)
It’s the end for them, I imagine.
I guess this is normal now
It's like fractals, not all dimensions are integers. If your one factor is extremely weak, then it's really only 0.x of a factor.
Actual security, add some zeros ;)
"If you are not [a bot], and you feel you have been served garbage by mistake, please contact the owner of the site you're visiting."
If anyone knows another way to access the content, I'd be interested. No contact details are offered and visiting mastodon.catgirl.cloud resets my connection.
- https://en.wikipedia.org/wiki/Semantic_Web
"The second part of the dream was that, [...] The computer renters the scene visibly as a software agent, doing anything it can to help us deal with the bulk of data..." - https://repository.cern/records/6kxvc-v6203/preview/dd-89-00... - https://www.w3.org/1998/02/Potential.html
This seems less-and-less extreme, daily. Free yourselves from your leashes!
----
Next time you're standing in line, strike up conversation (about anything) with your ugliest linemate (it doesn't even matter about what, just offline communication)...
Maybe ya'll both like ZFS or "heard about that PHP thing!?" (I used both conversation starters, today – it worked – I can be the ugliest, too).
If you prefer wordless silence, pulling out a phone (or book/magazine) works well when talkers "don't take the hint;" or face away (for particularly invasive conversation starters).
My hope is that small talk leads to shared connections, perhaps even (a brief intertwining of) humanity.