I reported an insecure DKIM key to Deutsche Telekom / T-Systems.

[millie@infosec.exchange]

@dragonfrog @badkeys Most people might not be fluent in base64-encoded ASN.1, but a trained eye can see that it's the same key.

Hint: A sufficiently strong RSA key cannot possibly be that short, and you know it's a DER-encoded pubkey because it starts with "ME" and ends with "AQAB" (0x10001, common RSA public exponent)

[mcr314@todon.nl]

@buherator @badkeys No, they thought they were generating an ECDSA key, for which a 256 or 384 bit would be strong. But, they didn't provide the right arguments, and wound up with RSA. I think the OP posted the private key that they were able to crack trivially.

[dragonfrog@mastodon.sdf.org]

@millie @badkeys
Oh gosh, so they've removed the private key, but it's still the public key that goes with a private key that they already published.

A sound as if a thousand faces rested in a thousand palms, and a thousand IT people sighed heavily...

[millie@infosec.exchange]

@dragonfrog @badkeys No, the private key was never published by t-systems, but it's so weak that it's very easy to crack. OP cracked and published the private key.

[buherator@infosec.place]

@mcr314 @badkeys Source? I doubt someone who makes a mistake like this knows what ECDSA is.

[dragonfrog@mastodon.sdf.org]

@millie @badkeys thank you, I get it now. Iguess I'm having a slow day!

[irelephant@app.wafrn.net]

@badkeys@infosec.exchange

send an email coming from them.

[bebef@mastodon.social]

@kkarhan @momo @badkeys @BNetzA @EUCommission Had the same issue just recently. I wonder how this can even be legal.

I wanted to ask a lawyer about this, but never came around doing so.

[16af93@wetdry.world]

@q @badkeys BSI at it again?

[q@glauca.space]

@16af93 @badkeys for once, its not the Germans

[16af93@wetdry.world]

@q @badkeys

[yacc143@mastodon.social]

@badkeys
That was crackable with private entity resources decades ago.

That's not even funny.

[sys64738@www.librepunk.club]

@q @16af93 @badkeys iirc 256-bit rsa is satcomms 'standards'

[tanja@mastodon.catgirl.cloud]

@badkeys@infosec.exchange oooofffff

But why would they turn down the bug bounty????

<img class="not-responsive emoji" src="https://content.mastodon.catgirl.cloud/custom_emojis/images/000/055/198/original/neocat_googly_shocked.png" title=":neocat_googly_shocked:" />

[jane@smolhaj.social]

@networkexception Now I want T-Systems involved into Synapse Pro development. Have an ISP approved way when your matrix message "is not decryptable" to decrypt it after a few hours of compute time. It's not a bug, it's a feature they provide if their bug bounty rejects this.

[lunareclipse@snug.moe]

@badkeys bad companies that don't pay out bug bounties can have uncoordinated public disclosure as a treat :3

[keksdosenmann@mastodon.social]

@badkeys Telekom. Die machen das.

[kkarhan@jorts.horse]

@Bebef @momo @badkeys Neither did I.

And the next-best qualified lawyer I'd know in that part is @wbs_legal.

• Sadly there's no legal precedent to establish the same "duty to deliver" as with #PostalOperators which ain't allowed to do anything unless explicitly instructed by the reciever or served a warrant by a judge.
  • And obviously regulators like @BNetzA & @EUCommission likely ain't even aware of this issue since #ConsumerProtection doesn't apply to #SmallBusinesses!

[yacc143@mastodon.social]

@Bebef
It's probably not, some countries have really tough laws that they apply to email delivery and privacy that makes even spam filtering a legally dicey proposition

But let me put it like this, who wants to sue a company that has a legal budget bigger than the whole government budget of some of the poorer EU MS?

And in the end as long as the users won't start moving their fat posteriors away from the big tech monopolies, ...
@kkarhan @momo @badkeys @BNetzA @EUCommission

[nitram2342@chaos.social]

@badkeys This is the mastodon method of converting a private key into a public key. Scnr.