As long as the smart TV still trusts eMudhra, then yeah. You'll want to super careful and prevent the TV from pulling updates that could revoke that trust.
Anyone else bother to notice iOS still trusts 2 of the forged certs on the test site? I'd like to politely know what the fuck is going on because this is far from being "fixed".
I agree. We may as well make some lemonade out of these lemons. IMHO the ability of companies to 'securely' close off hardware and software from their users is a sad casualty of the success of cryptography, and not a feature.
It's almost a shame it includes the private key and doesn't bruteforce it in-band for every request.
If I’m understanding correctly, you could sniff the communication between your Smart TV and the manufacturer using this method?
As long as the smart TV still trusts eMudhra, then yeah. You'll want to super careful and prevent the TV from pulling updates that could revoke that trust.
Possibly. But some manufacturers may not have the full set of roots, use a private authority, or do certificate pinning.
If the TV isn't older than a few years, if it's not checking CRLs, and if it hasn't yet patched itself.
How much of a boon is this for jailbreaking, reverse engineering, and mitm really?
Been wondering this as well. I also don’t really understand the mitm to jailbreak pipeline
This is gonna be great to sniff apps in a couple older Android phones I have around. Hope they're not pinning certificates.
Can someone explain the significance here, a lot has happened in 24 hours.
Someone should've coined this disaster as "QuattroFail" to give it a little panache and international mystery
"4" was only some of the keys (they were all <256).. ByteFail seems more accurate
Haha, this is quite interesting to test if you need to update various of program (if they do not use the sys ca chain)
[delayed]
This is how fame happens.
Never thought there would be a silver lining on this issue. Fuck yeah.
Wonderful.
Anyone else bother to notice iOS still trusts 2 of the forged certs on the test site? I'd like to politely know what the fuck is going on because this is far from being "fixed".
Which iOS version? 27.0.1 here and they're all revoked for me.
26.7.1 still (randomly) trusts 2 out of the 12 compromised chains. All browsers impacted.
Randomly because first it was one, then two after visiting the page again.
Edit: and I'm not the only one with this issue:
https://www.reddit.com/r/iphone/comments/1xbvxgd/emudhra_cer...
FWIW i havent updated my ios, I'm on 26.6.2, and they all got revoked for me. The revocation shouldn't require an iOS update.
I love how someone's security disaster becomes someone else's feature.
I agree. We may as well make some lemonade out of these lemons. IMHO the ability of companies to 'securely' close off hardware and software from their users is a sad casualty of the success of cryptography, and not a feature.
Most things have tradeoffs
At some point you’re forced to stack rank two or more of your values in a case where they’re mutually exclusive
I seriously laughed at the flag. public wifi is going to be lit.