I reported an insecure DKIM key to Deutsche Telekom / T-Systems.
-
@stellated @kkarhan @momo @badkeys It works like this: send an email to a Telekom recipient. Mail bounces with
<xxxxx@t-online.de>: host mx03.t-online.de[194.25.134.73] refused to talk to
me: 554 IP=1.2.3.4 - None/bad reputation. Ask your postmaster for help
or to contact tobr@rx.t-online.de for reset. (NOWL)
Send an email to tobr@rx.t-online.de, hilarity ensues.
(They send a reply pointing you to https://postmaster.t-online.de/#t4.1)
@stellated @kkarhan @momo @badkeys Bit more discussion in German to be found here: https://borncity.com/blog/2025/02/25/merkwuerdige-vorschriften-bei-der-telekom-fuer-e-mail-versand/
-
I reported an insecure DKIM key to Deutsche Telekom / T-Systems. They first asked me to further explain things (not sure why 'Here's your DKIM private key' needs more explanation, but whatever...). Then they told me it's out of scope for their bugbounty.
I guess then there's really no reason not to tell you: They have a 384 bit RSA DKIM key configured at: dkim._domainkey.t-systems.nl
384 bit RSA is... how shall I put it? I think 512 bit is the lowest RSA key size that was ever really used. 384 bit RSA is crackable in a few hours on a modern PC (using cado-nfs). The private key is:
-----BEGIN RSA PRIVATE KEY-----
MIHxAgEAAjEAtTliQYV2Xvx1OGkDyOL799BTFEuobY2dn2AgtiKCQgrh78NVK1JK
j0yRXgNnPpGBAgMBAAECMF0t+TBZUCi8xATSMij7VLTxv5Xi5OIXesNiXOKtYIRP
LkpYfR5PggaMScfbmqSssQIZAMwOhm9d7Y7Qi7I2j1AlYbiqdtqO54T7FQIZAONa
9dJFkC6lM3EPXR+0SZ4dqwwpiM0nvQIYYgz8thi5JK264ohq9sTvnu9yKvUN9I09
AhgfgMYZKcxtujRjkSZtMzUUNLYzzDmJe90CGDKwqcBI0v9ChaR8WHht+/chMdxj
7ez94w==
-----END RSA PRIVATE KEY-----@badkeys i didn't know anything below rsa-1024 even existed!
