Slashdot Mirror
Researchers Find Same RSA Encryption Key Used 28,000 Times
itwbennett writes In the course of trying to find out how many servers and devices are still vulnerable to the Web security flaw known as FREAK, researchers at Royal Holloway of the University of London found something else of interest: Many hosts (either servers or other Internet-connected devices) share the same 512-bit public key. In one egregious example, 28,394 routers running a SSL VPN module all use the same 512-bit public RSA key.
This is a real problem and I don't mean to minimize it. But weak encryption is infinitely better than none, and the solution to this is immensely easier than the solution to the many, many wholly unencrypted connections that are happening this very moment. I think we should prioritize getting all connections everywhere encrypted somehow.
If video games influenced behavior the Pac Man generation would be eating pills and running away from their problems.
Then it deserves at least social shaming and ostracism, if not worse than those minor responses to venial sins. Protecting the manufacturers only creates an environment where the incentives are aligned for them to do it again. If manufacturers aren't keenly aware that they need to protect their reputation, then they will cut every corner that doesn't provide them a competitive advantage.
My God, it's Full of Source!
OUTSIDE_IP=$(dig +short my.ip @outsideip.net)
there is no such thing as security any more using the common models and parameters. got to step it up, without fallback to silliness like 512 bit keys. the bigger problem is nobody has been bankrupted and sent to jail yet, so the impetus is not there to fix it as the first priority of business.
if this is supposed to be a new economy, how come they still want my old fashioned money?
Similar mistake have been made before.
Have gnu, will travel.
First line of the article:
"What if the key to your house was shared with 28,000 other homes?"
The fact is, you very well might share the key to your house with more than 28000 other homes. Common lock brands you can buy at Home Depot, Lowe's, etc. create a surprisingly low number of different key/tumbler combinations.
Popisms.com - Connecting pop culture
*.myfoscam.org/organizationName=ShenZhen Foscam Intelligent Technology Co,Ltd
Seems to be a network enabled camera.
Create a function to generate a random key.
Comment removed based on user account deletion
Ahem. Unlike you, manufacturers can get keys which can sign other keys. Which means they can buy 1 key and generate as many sub-keys as they like.
Putting 1 key into a image vs having a different key go into every image.
One is cheap, the other isn't. (when pennies count).
These are not certificates. They're not validated by any trusted authority. These are host keys: you generate them yourself for the cost of electricity. You could have your router generate its own keys the first time it starts up for the cost of a couple seconds delay.
You could use your own CA and generate self signed certificates.
You do realize these are self signed keys? They are trivial to generate and have no cost.
No sir I dont like it.
http://www.reuters.com/article... NSA ~ RSA
We should learn what we need to know about issues, before we decide what we need to feel about them.
Without SALT even encryption is bland. Try searching encrypted password hashes on google it's always interesting to see who you share the same password word. Often the userid is revealed in the search, if the userid is unique you can search the userid out and find new sites to try your new acquired user:pass combo's.
Once I know the key is good, I stick with it and use it everywhere. Why to mess with it if it's working?
Most people doing anything on the internet have no functional literacy in security. WEP, WPA, SSL, https,...it's all alphabet soup mumbo jumbo to most people.
Now, some self-appointed expert is going to chime in in a few moments and say that these ignorant fools need to educate themselves about this, and if they get pwned it's all their own fault.
The problem *is* that people need to be educated, but right now to truly understand the rudiments of security technology and the risks probably requires some night classes more suited to IT professionals. If that is the burden on the user, security will never work.
People understand locks and keys on their cars and doors, and know the consequences of not using them. The same can't be said for internet security. Most people are stuck relying on the kindness of strangers to implement security for them, and that is just asking for trouble.
The person who solves this problem, of making internet security understandable by the lay user, will be doing the world a great service.
Left MS Windows for Linux Mint and never looked back!
Vote for Bernie in 2016!
How would you make a list of what are supposed to be private keys?
Oops.
FTFY. ;-)
Those who do study history are doomed to stand helplessly by while everyone else repeats it.