Nov 12, 2026, 7:58 PMbad idea: bot that tries to automatically factor all TLS secrets, but is limited to just trying the first couple thousand numbers
it shouldn't ever succeed. and yet, if it does, we know something has gone very wrong
- Nov 12, 2026, 7:58 PM
Replies
- Nov 12, 2026, 7:58 PM
I almost said "the first couple thousand primes" but obviously that'd be a mistake
- Nov 12, 2026, 11:35 PM
yeah turns out I'm not the first person to have this idea, and they're already working on it!
Nov 12, 2026, 8:37 PM@foone well it's not like any would use a non-prime number like 4 or something
Nov 13, 2026, 12:32 AM@foone might be worth checking all bits set as well
1000millimeter1000millimeter@chaos.socialNov 12, 2026, 8:03 PM@foone Isn't part of "random" that you in fact may guess the correct secret on the first try, it's just extremely unlikely?
Jess👾JessTheUnstill@infosec.exchangeNov 12, 2026, 8:06 PM@foone I mean, there's only what, a few thousand root CAs and intermediates, test out the first 10k digits or so, even a regular desktop could churn that out in a day or two.
Talya (she/her) 🏳️⚧️✡️Yuvalne@433.worldNov 12, 2026, 8:23 PM@foone that's essentially how that 4 key was discovered, wasn't it? someone who didn't expect to get a positive result got one?
Nov 12, 2026, 8:25 PM@foone apparently Tom7's LetsEncrypt cert got revoked because they factored his intentionally shitty RSA key. I kind of assumed this was already being done.
Nov 12, 2026, 8:42 PM@foone someone should do that for real to root out any potential eMudhra 2: Electric Boogaloo situations while people are still in damage control mode
miifoxmiifox@akko.chir.rsNov 12, 2026, 8:56 PM@foone i think reading at sometime that it existed but was never put into production cause "surely nobody would be that stupid"
Andrew Zonenbergazonenberg@ioc.exchangeNov 12, 2026, 10:08 PM
Lady Erranterrant@mastodon.sdf.orgNov 12, 2026, 11:37 PM@foone Thats one of those things that I always just assumed existed but nope, guess not
NumerfoltNumerfolt@kirche.socialNov 13, 2026, 5:53 AM@foone I don't fully understand what your idea is, would you mind explaining it to me?
I know it has something to do with the eMudhra incident and you basically want to look for more vulnerable certificates?