Slashdot Mirror
Adobe Security Team Accidentally Posts Private PGP Key On Blog (arstechnica.com)
A member of Adobe's Product Security Incident Response Team (PSIRT) accidentally posted the PGP keys for PSIRT's email account -- both the public and the private keys. According to Ars Technica, "the keys have since been taken down, and a new public key has been posted in its stead." From the report: The faux pas was spotted at 1:49pm ET by security researcher Juho Nurminen. Nurminen was able to confirm that the key was associated with the psirt@adobe.com e-mail account. To be fair to Adobe, PGP security is harder than it should be. What obviously happened is that a PSIRT team member exported a text file from PSIRT's shared webmail account using Mailvelope, the Chrome and Firefox browser extension, to add to the team's blog. But instead of clicking on the "public" button, the person responsible clicked on "all" and exported both keys into a text file. Then, without realizing the error, the text file was cut/pasted directly to Adobe's PSIRT blog.
This article is clearly a lie. How can a mythological entity have a PGP key?
But they can revoke it, can't they? An embarrassing screw-up, but no harm done. It's not as if the Adobe security team's credibility was particularly stellar to begin with... :)
How the hell did their PGP key even end up on their webserver?!?!?
The summary was all of 7 sentences; 3 of them were dedicated to the answer to this very question.
We will stop seeing these kinds of articles, since it is a daily occurrence, and just assume someone somewhere was hacked in a major data breach.
Agent K: A *person* is smart. People are dumb, stupid, panicky animals, and you know it.
...humanities majors keep getting IT security jobs. No such thing as foolproof if a fool does the proofing.
As much as I hate Adobe and most of their shitware, I don't think it's fair to totally fault the poor person who did this.
But instead of clicking on the "public" button, the person responsible clicked on "all" and exported both keys into a text file.
If a mistake of this magnitude is a single misclick away from happening - something that's really easy to do in a moment's careless mistake of the type EVERYONE has - something is broken with that UI.
There should be warnings in red you have to override with an explicit and nontrivial action.
Because if a good passphrase is used, then this is a complete non-issue.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
Actually, it is not. Just as with the functioning of a house-key, there is a minimal understanding that is required for public-key crypto, or security will not be provided. Yes, that means many people cannot have secure encryption. That is just the way things are. Wishing things to be different does not change them.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
And just like that, all email ever encrypted with that key is subject to decryption.