Slashdot Mirror
Adobe Security Team Accidentally Posts Private PGP Key On Blog (arstechnica.com)
A member of Adobe's Product Security Incident Response Team (PSIRT) accidentally posted the PGP keys for PSIRT's email account -- both the public and the private keys. According to Ars Technica, "the keys have since been taken down, and a new public key has been posted in its stead." From the report: The faux pas was spotted at 1:49pm ET by security researcher Juho Nurminen. Nurminen was able to confirm that the key was associated with the psirt@adobe.com e-mail account. To be fair to Adobe, PGP security is harder than it should be. What obviously happened is that a PSIRT team member exported a text file from PSIRT's shared webmail account using Mailvelope, the Chrome and Firefox browser extension, to add to the team's blog. But instead of clicking on the "public" button, the person responsible clicked on "all" and exported both keys into a text file. Then, without realizing the error, the text file was cut/pasted directly to Adobe's PSIRT blog.
This article is clearly a lie. How can a mythological entity have a PGP key?
But they can revoke it, can't they? An embarrassing screw-up, but no harm done. It's not as if the Adobe security team's credibility was particularly stellar to begin with... :)
How the hell did their PGP key even end up on their webserver?!?!?
It doesn't have to be like this. All we need to do is make sure we keep talking.
We will stop seeing these kinds of articles, since it is a daily occurrence, and just assume someone somewhere was hacked in a major data breach.
Agent K: A *person* is smart. People are dumb, stupid, panicky animals, and you know it.
...humanities majors keep getting IT security jobs. No such thing as foolproof if a fool does the proofing.
That's a key point and a key contributor to Internet insecurity. One could argue that, to make it 'perfect', the designers of PKI have made it unusable by the average user. And the OS vendors (Microsoft, Apple and Linux community) have not helped. Nor have the purveyors of PKI credentials, again to make trust "absolute", the cost and 'annoyance overhead' makes getting your own key too difficult for anyone short of a fully qualified IT department with PKI expertise.
As much as I hate Adobe and most of their shitware, I don't think it's fair to totally fault the poor person who did this.
But instead of clicking on the "public" button, the person responsible clicked on "all" and exported both keys into a text file.
If a mistake of this magnitude is a single misclick away from happening - something that's really easy to do in a moment's careless mistake of the type EVERYONE has - something is broken with that UI.
There should be warnings in red you have to override with an explicit and nontrivial action.
Adobe has such a long history of putting security first and demonstrating security best practices! How could this sort of thing happen? Or is it because a typical Adobe employee doesn't know the difference between private key and a hole in the ground.
Because if a good passphrase is used, then this is a complete non-issue.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
And just like that, all email ever encrypted with that key is subject to decryption.
gpg is not that hard, the true is that mailvelop is shit ... export public key is a common task... exporting the private key do not, so it should be in a totally different place with a proper warning
also google, yahoo, ms, etc should include support for gpg in their webmail ... gpg looks hard because most tools do not support it. integrate then and things will be easier
Higuita