• Trainguyrom@reddthat.comEnglish
    9·
    1 day ago

    Some number of years ago I worked in support for a mobile phone manufacturer. I spoke with one person who found themselves on the certificate section of Android and had disabled every non-american certificate then was shocked when their device basically stopped working…

    • Wirlocke@lemmy.blahaj.zone
      10·
      22 hours ago

      These certificate companies are responsible for keeping internet traffic encrypted.

      They use a private key which you can imagine as a combination number lock of 116 digits.

      This specific company seemed to only be generating numbers that fell in the range of 0 to 256, and at the time of the breach the smallest one was 4.

      I want you to imagine your data being secured with a lock using a numpad of 116 digits. Now imagine the passcode turned out to be 115 zeros and then 4.

    • homosapien@lemmy.dbzer0.comEnglish
      4·
      1 day ago

      emudhras certifications got pwned so anyone can pretend to be anything with an emudhra certificate. Android lets you stop using certain certificates

    • GreenKnight23@lemmy.world
      3·
      9 hours ago
      1. certificates encrypt web traffic
      2. companies exist to create world trusted certs
      3. these certs are signed by their private key with a random hash generated that’s globally unique
      4. is not random enough

      edit: I love that there’s only 4 upvotes on this. 🤣

  • Victor@lemmy.world
    91·
    1 day ago

    Thanks for the tip! I can’t imagine what the person was thinking who down voted this. Must have slipped on the wrong button.

    • AdrianTheFrog@lemmy.worldEnglish
      4·
      21 hours ago

      pretty much anything that gets more than like 100 upvotes will have at least one downvote (including lemmy, reddit, youtube before they effectively got rid of dislikes, etc), I also don’t really know why but it’s basically universal

      • JackbyDev@programming.devEnglish
        5·
        1 day ago

        For the curious, down votes on stuff native to an instance that doesn’t have down votes just won’t federate the down votes. So essentially, any down votes anyone sees is from their own instance.

      • Victor@lemmy.world
        4·
        1 day ago

        5 down votes now, who in their right mind…

        But 500+ up votes and counting 😎 The haters are getting ratioed!

        Good post!

        • Melvin_Ferd@lemmy.world
          32·
          1 day ago

          Why the hell are you guys looking at voting. It’s a left over to placate users after they just went full overseer mode with our spaces. It’s a digital key chain they dangle. It doesn’t do anything

            • Melvin_Ferd@lemmy.world
              1·
              10 hours ago

              No it has practically no impact. Back in the day it would. But user control means users could control how a website works. It meant we could reject ads or posts that were secretly selling us things or just political message that users controlled. Reddit and the other sites removed what it was originally for and left its dead corpse for us to feel like we’re doing something.

              These spaces are all mods. Mods determine what we see. Lemmy decided to implement the same corporate control the reddit evolved into rather than the more liberal/leftist origins that made it popular at the start.

              Moderators are not normal people. They should have almost no say in anything. The only reason to give them so much control is if you’re trying to create propaganda machine. Mods should only be there to remove illegal content and maybe protect against a brigade. Users take care of the rest. It’s literally how many leftist want society to run. Yet for some reason we use this overseer type model where mods abuse power every day and we just ignore it like we’re a police department. It’s ok as long as it gets the job done right boys.

          • Victor@lemmy.world
            2·
            21 hours ago

            It’s pretty obvious from the first comment, no? I was surprised to see anyone down voting this at all because it’s just plain, objectively sound advice.

            But in the end the ratio of up/down is still comforting and not so disappointing.

            Makes sense?

  • Buddahriffic@lemmy.world
    3·
    1 day ago

    Only had one on my device, but I disabled it. Even if this one isn’t openly compromised like the others, it was a big sign that the company is either incompetent or corrupt (or both).

  • meejle@piefed.worldEnglish
    38·
    3 days ago

    If anyone else here uses AdGuard, the latest version of their app rejects the affected certificates. 👍

  • state_electrician@discuss.tchncs.de
    451·
    3 days ago

    I once tried to disable all but the ones I actually need. There are close to 200 CAs trusted by my devices and I only need to trust about 15 of them. But it’s a colossal pain in the ass to figure out which CA an app needs, so I abandoned that experiment.

    • printf("%s", name);@piefed.blahaj.zoneOPEnglish
      15·
      3 days ago

      Yeah, I too had that ambition once, but I didn’t even know where to begin, since I don’t know how to find out which once my apps, websites and other services actually need. Other than investigating whole chains of collaboration between the various owners and devs of those services. Arduous much? 😅

      • state_electrician@discuss.tchncs.de
        8·
        2 days ago

        I used a proxy to look up which servers the app was trying to talk to, looked up the cert from the server and which CA I needed. It was very arduous, especially when you installed a new app and just wanted to use it, e.g. for parking. This made me stop doing this. When giving talks to junior devs I used to explain that security and convenience are almost always on opposite sites and you need to figure out where between the two extremes you want to sit. In this case I opted for convenience.