Database of Private SSL Keys Published 200
Trailrunner7 writes "A new project has produced a large and growing list of the private SSL keys that are hard-coded into many embedded devices, such as consumer home routers. The LittleBlackBox Project comprises a list of more than 2,000 private keys right now, each of which can be associated with the public key of a given router, making it a simple matter for an attacker to decrypt the traffic passing through the device. Published by a group called /dev/ttyS0, the LittleBlackBox database of private keys gives users the ability to find the key for a specific router in several different ways, including by searching for a known public key, looking up a device's model name, manufacturer or firmware version or even giving it a network capture, from which the program will extract the device's public certificate and then find the associated private SSL key."
DD-WRT? (Score:4, Interesting)
Re: (Score:3, Informative)
Re:DD-WRT? (Score:5, Informative)
that's the SSH key. The article is talking about the SSL key used by the embedded web server, ie. when you go to https://192.168.1.1/ [192.168.1.1] . TFA also specifically says this DOES affect DD-WRT.
Re: (Score:3)
that's the SSH key. The article is talking about the SSL key used by the embedded web server, ie. when you go to https://192.168.1.1/ [192.168.1.1] . TFA also specifically says this DOES affect DD-WRT.
From TFA: "Although at the moment the vast majority of the keys belong to various DD-WRT firmware, there are keys from Cisco, Linksys, D-Link and Netgear as well."
Damn. I missed it. Thanks for pointing that out!
Re:DD-WRT? (Score:5, Interesting)
DD-WRT, at least, installs with no SSL certificate in place and auto-generates one the first time it starts up.
This is really the correct solution, and a number of home routers actually do it.
Of course, there's a tradeoff. If you use a fixed certificate, you can have it legitimately signed. Then, if someone does a man-in-the-middle attack, you get the browser warning that they're using a self-signed certificate. Unless, of course, they're using the real fixed certificate. If, on the other hand, you use an autogenerated certificate, then the self-signed cert browser warning always appears (as you can only autogenerate self-signed certificates). The user learns that clicking through this warning is a necessary part of changing their router configuration. Then, any man-in-the-middle attack works, since anyone can make a self-signed certificate. (Yes, if they or the browser store the original cert and compare it to the new one, then this is no longer an issue.)
Realistically, I think this is a non-issue. If you're using home routers, they should only be configurable from the wired LAN, and only trusted people should be on that network.
House guests (Score:2)
If you're using home routers, they should only be configurable from the wired LAN, and only trusted people should be on that network.
Then what's the polite way to tell house guests why you're not letting them check their Facebook?
Re: (Score:2)
Then can you fix the problem at my end for me? (Score:2)
Silently drop DNS requests to facebook.com and shrug and say it must be a problem at their end when they ask?
Then they'd try Google, their webmail, and other sites on their Favorites, and see that I'm silently dropping everything. Then they'd bug me to troubleshoot the "problem at their end" for free, and if I refuse to whitelist the MAC of their laptop or tablet, and I further deny them the use of one of my own computers "just for a minute" that inevitably turns into fifteen or more, I'm perceived as inconsiderate.
Re: (Score:2)
You don't have to let people into the admin panel of your router in order for them to visit facebook
You have a point there.
nor do you have to let them onto your wired network.
What is the difference between giving them access to the wired network and giving them the preshared key for WEP or WPA2? And wouldn't it be a dick move to reject the kid's classmate's Xbox 360 (I used Facebook as an example; it is not the only one) because the kid's classmate ordinarily uses an Ethernet cable instead of buying the expensive proprietary wireless kit?
Re: (Score:3)
What is the difference between giving them access to the wired network and giving them the preshared key for WEP or WPA2?
The difference is that many home routers have an option to only allow devices on the wired network to configure the router. Anyone connected to the wireless network, if this option is enabled, isn't in a position to be able to do a MitM attack when you change the configuration. (On wired+wireless home routers, the network appears to be a single LAN, but is usually really a pair of bridged LANs, one for wireless and one for wired.)
Now, some routers are fancier and can be set up with VLANs to permit only the
Re: (Score:2)
"Sorry, it's my work computer."
"Then why did I just see you playing a game on it?"
Or, just don't admin your router when they're on the network
How inconsiderate would it be to fake a fire drill, requiring the guests to evacuate the house and stay in the freezing outdoors for several minutes, while I open a port?
or be a real admin and generate your own cert.
How can a router manufacturer make it easy for most home users to do this (and to get the cert into the browser)?
Re: (Score:2)
Then what's the polite way to tell house guests why you're not letting them check their Facebook?
Simple: don't log in to the management interface of your router while you have untrusted house guests. Indeed, a man in the middle can only spy upon a conversation that takes place.
Now, if your guests ask you to reconfigure your router because they need something special, just pretend you don't know how to do that, or that you forgot your password.
Or, alternatively, only take in trusted house guests.
Re: (Score:2)
if your guests ask you to reconfigure your router because they need something special, just pretend you don't know how to do that, or that you forgot your password.
I could claim that online games that need incoming connections have to go through a vetting process. But with my disability, I don't know to what extent it'd be considered a dick move.
Or, alternatively, only take in trusted house guests.
That'd certainly be a dick move, especially if I am culturally expected to take in members of my extended family and friends of others living with me.
Re: (Score:2)
Then what's the polite way to tell house guests why you're not letting them check their Facebook?
This may make no sense whatsoever, but, could you have your wireless access point sitting between your modem and your network - i.e. so that someone accessing the Wi-Fi network does not have access to the internal network. If you want to access something on the network via Wi-Fi, you VPN back into it - everyone gets to access Facebook etc., but not content on your LAN.
If you need, restrict access to the a
Re: (Score:2)
could you have your wireless access point sitting between your modem and your network - i.e. so that someone accessing the Wi-Fi network does not have access to the internal network.
I could, but most home routers don't appear to support such a VPN setup out of the box, and most end users don't want to sit down for hours reading up on network security principles and the details of how to set up a VPN, especially when VPN is considered a "work thing", not a "home thing". The economies of scale in the home market currently favor devices whose design chooses convenience over security.
Re: (Score:2)
most home routers don't appear to support such a VPN setup out of the box, and most end users don't want to sit down for hours reading up on network security principles
A fair point indeed - I guess I was just proposing a solution to the problem, based on my own considerations about wanting to enable guest/visitor Internet access, but not wanting everyone on the LAN, and that it was not necessarily a solution which would be feasible/desirable for everyone.
Another solution might be Apple's Airport Extreme, which I believe will broadcast a guest Wi-Fi network, which doesn't touch the LAN side.
Re: (Score:2)
Generally, house guests should be using the wireless network. The router should be configured so that the wired network, but not the wireless, is permitted to access the router configuration.
Re: (Score:2)
Generally, house guests should be using the wireless network.
Then the excuse, based on my experience, would be as follows: "At home, I always used an Ethernet cable with my Xbox 360, so I never felt the need to buy the proprietary wireless adapter that costs as much as two used games [google.com]."
Re: (Score:2)
I don't understand. Are you saying that you don't have a wireless network at all, or you're talking about house guests using the Internet through your Xbox 360?
Running your own limited-functionality devices on your wired network is acceptably safe, regardless of who's actually using the device, is permissibly safe.
Re: (Score:2)
Scratch the second "is permissibly safe". I need more coffee.
Re: (Score:2)
And anyways that means I'd have to have a wire strung around just to do the management of my wifi. I can do that of course but it's damn inconvenient if I put the router in say the attic or something.
Re: (Score:2)
As for stringing cables. If the router is not in a place that you can just walk up to it, having a cable 'strung around' is irrelevant. There are wires strung around your whole house behind the walls, under the floors, and in the attic. If it is where you can walk right up to it, don't leave the cable strung around. Plug it in as needed.
That being said, security on your router isn't any different than any other security you m
Re: (Score:2)
If your network is wireless-only, clearly this won't work, and I think it's a fair request to want a wireless-only network.
Re: (Score:2)
The self-signed certificate applies to a lot of routers for small business and enterprise. It does not make sense to spend that much money just to get a cert from an authority.
I know that, for at least myself, the answer is VPN. So I am always configuring the routers from the LAN regardless of where I am. As a backup we allow a small number of trusted hosts to manage devices from the WAN. So from the datacenter we can always hit various branch offices and clients without a problem.
Re: (Score:2)
At the business and enterprise level, it's reasonable to demand more rigor, is all. For example, if you can install your own cert, then you can have your own non-authoritative CA, sign your router certs with that, and install the non-authoritative CA's cert on the machines that need to configure the router. Or, make sure your machines that are allowed to configure the router are using a system where the SSL cert is stored and checked in the future so that you can detect MitM.
Of course, there's always the wo
Re: (Score:2)
Thanks for this post. Could you explain why TFA says that DD-WRT routers are affected by this? If they behave as you describe (which is how I thought they behaved) why does the article indicate they are vulnerable to the static ssl key problem? Thanks for any info.
Re: (Score:3)
Did your router generate it or did the MITM? (Score:3)
My DD-WRT router generates a new cert every reboot.
If your router appliance firmware generates a new keypair and certificate every time you restart it, you'd have no easy way to tell whether you generated a given certificate or the man in the middle generated it. Even key continuity management fails in such a case. Who signs such certs? What am I missing?
Good... (Score:4, Insightful)
VENONA (Score:5, Interesting)
Encryption is only as strong as the idiots who implement it. The Soviets learned that the hard way during the early part of the Cold War, when they accidentally reused random one-time pad encryptors. That led to the NSA's VENONA project, and we decrypted a pretty good amount of Soviet diplomatic and spy traffic before they were tipped off.
Old problem (Score:5, Interesting)
Apple ran into something similar a long time ago for Mac OS X Server. The servermgrd daemon uses a self-signed SSL cert by default to secure communications with remote management tools. About four or five versions back the certificate was identical across all installations because it was contained in the installer package. Someone had to go down and show them that you could read all of the traffic by using sslsniff and the private key from your own copy of the installer. They changed to an individual, automatically generated certificate shortly thereafter.
--Paul
Misleading? (Score:3, Insightful)
From the article: "...making it a simple matter for an attacker to decrypt the traffic passing through the device". I'd think it would only be *to* the device.
Misleading^2 (Score:5, Informative)
I'd think it would only be *to* the device
That, and I think the attacker has to be on the network you're using to administer the device.
For a home router, with remote administration hopefully disabled, that would be your local net. So, if you have an attacker in your living room https: // 192.0.0.1 (or whatever) won't be any saver than http: // 192.0.0.1
Re: (Score:2)
Bingo. If they already have a sniffer on your local network, you were compromised long before they decrypted your routers login.
Most people send way more information over regular HTTP during the course of the day that you can imagine (people still using non SSL/TLS pop3/imap or SMTP is a great one).
Re: (Score:3)
If your wifi network is secured with WPA then I think HTTP traffic is encrypted to the router, no? And WPA isn't subject to this vulnerability b/c it has it's own user-generated encryption key, right? So this is only a problem if you're running an open wi-fi network (or using WEP ugh). Am I missing something?
Also known as... (Score:4, Funny)
Wrongo (Score:2)
Router as a closed proxy (Score:2)
Encrypted traffic going through the device to another nonidentical host will use a different private key.
If you're using your router appliance as the endpoint of an HTTPS tunnel [wikipedia.org], then tunneled HTTP traffic will be unencrypted after it leaves the appliance. It appears this would let someone sniff passwords for blogs, forums, and wikis, many of which don't use HTTPS due to the cost of a hosting plan including a dedicated IPv4 address, if someone can't sniff the route from the proxy to the HTTP site but can sniff the one from you to the proxy.
Not really trivial (Score:2)
Now what?
Remeber, you got the router key, not Alice's or Bob's!
Ok maybe I am missing something but... (Score:2)
So if I have WPA2 on and configure my router via a wire how would knowing my routers SSL key be all that valuable?
Re: (Score:3)
Most routers can be configured to allow you to connect remotely over the Internet, using https to 'protect' your admin session. In practice, I don' know why most people would need to do this - for the most part, once you get one of those configured, you basically leave it alone forever. I suppose if you had a need to turn on port forwarding on some port, remotely, perhaps you'd want this. Maybe someone administering the router for a relative, friend, or client might want to enable it.
In any case, in the sce
People change default router passwords? (Score:2)
Do people really change the passwords on their home router?
I suspect not...so this is pretty much a moot hack. I mean, why go through the trouble of sslsniff when you can just log in as admin/admin?
http://www.phenoelit-us.org/dpl/dpl.html [phenoelit-us.org]
I told you - I was one of those (Score:2)
You can't imagine the amount of griping this slowdown caused from the product/marketing teams. They really really wanted it hard-co
A possible security control for home networks (Score:2)
A possible security control for home networks would be to disconnect from the public network when you are doing administrative work on the router. Then unless the attacker has already placed a sniffer on the home network, the encrypted login credentials would not be visible from the public network while the administrative work was being done.
If the work involves the public network, perhaps the approach would be to disconnect during the login process and reconnect afterward. That might not prevent the atta
Re:what? (Score:5, Informative)
Re: (Score:2)
So what's the attack scenario? I'm at work and a malicious co-worker can use this against me, how?
Re:what? (Score:4, Informative)
Re: (Score:3)
You are at work and you decide to login to your home router's web server to look at statistics or make a change or whatnot.
A coworker sniffing your https traffic can decode it because he has the key. He can then see your administrative password and login to your router.
Re: (Score:3)
You are at work and you decide to login to your home router's web server to look at statistics or make a change or whatnot.
Administering a home router from outside the firewall was already known to be foolhardy. How many people allow remote administration of their router? If a home server is also hosted on the router, or is protected from remote administration only by the router, then it is also placed at risk by allowing remote administration of the router.
Our router only accepts administration from behind its firewall. Our web server only accepts administration from a subset of IP addresses behind the firewall (and not inclu
Re: (Score:2)
Yeah really. The only moderately plausible attack vector that I can see is this:
1) I run an unencrypted wi-fi network at home
2) I connect to my router to administer it via https thinking that is secure
3) Anon listens to the wi-fi network and can unwind the https session giving them access to the router.
4) Profit? I guess they can mod the settings and do something nasty - maybe redirect DNS to give them power over what I think are root key certs etc.
Re: (Score:2)
We're talking consumer-grade equipment here. These are the people who don't think twice about using their birthdate as a password. Neither would they think twice about logging into their router from outside, say to access the file store that modern APs allow to be attached by USB, for example.
Re:what? (Score:5, Informative)
2) Attacker is either listening passively or is a man in the middle (via ARP poisoning or what have you). Because they have the private key, they can advertise themselves as being the router without raising the alarm with your SSH client or browser
3) You provide credentials to the router (or MITM). The credentials are logged by the attacker
4) You proceed to do whatever you intended to do in the router's configuration, and log out.
5) Some time later, the attacker logs into the router as you, and makes nefarious changes to the router configuration (such as uploading compromised firmware which logs traffic, or has a backdoor, etc). Any changes done look like they've been done by the router administrator.
I don't know how likely this is in a work scenario though; I haven't searched the database for common mid-level to enterprise routers/remotely configurable switches. More than likely, in a work situation, you'd be using hardware which generates a key pair upon initial configuration. The scenario above is more likely to apply to SOHO, or to consumer wireless hardware in the home.
Re:what? (Score:4, Interesting)
More than likely, in a work situation, you'd be using hardware which generates a key pair upon initial configuration. The scenario above is more likely to apply to SOHO, or to consumer wireless hardware in the home
I'm vaguely shocked that any home routers would be using hardcoded private keys. That would be like every Schlage front door knob having identical keys. It's not just a mistake, it's extremely negligent security 101.
Re: (Score:2)
The companies that make these things are interested in interoperability, price, and security theater. Note that real security isn't on that list.
Re: (Score:2)
That would be like every Schlage front door knob having identical keys.
They (mostly) all do - it's the Bump key [google.com].
Re: (Score:3)
+1
Any device made by a sane security designer would either generate a key pair where a cert would be sent to the device maker to be certified, or have a unique private key installed at the factory where it can be signed with a CA before it ships (although this gives the issue of trusting pre-generated keys even though they are individual and different per device.)
With how brutal attacks through the Internet are, this is bordering on criminal negligence on a massive scale.
Of course, it looks like the only wa
Re: (Score:2)
Every browser insisting that a self-signed certificate is less secure than non-encrypted http would probably play a big role in why router manufacturers have chosen hard-coded keys rather than auto-generated ones.
Yeah, because we should allow our browsers to accept a self-signed key for www.mybank.com in order to make life easier for router manufacturers.
Totally.
Re: (Score:2)
Self signed certificates are ALWAYS more secure if you can trust the issuer. For instance if I went to my local bank branch and the manager there handed me a key in person and told me to go home and install it to validate their online site, that would be better than the Verisign cert they use now.
It only requires I trust the bank and not a third party CA as well, which I know from experience buying them that they don't always do the due diligence correctly.
The practical way to do this for the home routers
In the case of the bank (Score:2)
For instance if I went to my local bank branch and the manager there handed me a key in person and told me to go home and install it to validate their online site, that would be better than the Verisign cert they use now.
Would they hand it to you on a CD? Tablets and netbooks don't have internal optical drives, nor do they necessarily come bundled with an external one. On a USB flash drive? Netbooks have USB host ports, but tablets and phones often (usually?) don't, and furthermore, blank USB flash drives are fairly expensive at retail (I don't know about wholesale). Besides, a targeted worm like Stuxnet could dick with the program that installs it to the operating system's key store, especially due to lack of file permissi
Re: (Score:3)
Christmas shoppers have been mentioning netbooks to me this year. When I state that they use their CDs, they are unaffected "--that's fine, all I have is MP3s!" or "won't watch DVD's that tiny screen!"
As their only tech, I'm seeing problem-solving on them will be a pain. Live USB workarounds don't mirror Windows's standard troubleshooting CD without a bunch of research. Also, adding their Turbotax and CD software will be a pain, because everyone finally groks flash drives, but nobody distributes software un
Re: (Score:2)
Self signed certificates are ALWAYS more secure if you can trust the issuer.
How do you trust the issuer when you don't have any way to know who the issuer is?
For instance if I went to my local bank branch and the manager there handed me a key in person and told me to go home and install it to validate their online site, that would be better than the Verisign cert they use now.
Dude, that key was created by an Elbonian hacker who's now going to steal your bank account thanks to his friend at the bank handing it out to customers who are dumb enough to trust a random self-signed certificate that's handed to them.
Re:what? (Score:4, Insightful)
Re: (Score:2)
Ideally, browsers should have three SSL security levels:
Self-signed SSL cert. For the average user, it shouldn't bring up a lock icon, but something different saying the site is using some basic, untrusted cryptography to communicate.
CA certs. Usual lock icon. Perhaps a green lock icon for the EV certs. I'd like to see a "temperature gauge" with CA certs, because I trust Verisign, Thawte, RSA, and Symantec far more than I do some CA in Elbonia who happens to have their root cert marked as trusted in the
Re: (Score:3)
Ideally, browsers should have three SSL security levels:
Self-signed SSL cert. For the average user, it shouldn't bring up a lock icon, but something different saying the site is using some basic, untrusted cryptography to communicate.
'Average users' are precisely the kind of people who have to be beaten over the head with the fact that they're connecting to a site with a self-signed certificate. Average users typically don't check for a lock icon in the first place, so they're sure as hell not going to check for a self-signed certificate icon.
The real problem is that the entire CA model is fundamentally broken, not that browsers give warnings for certificates that might be OK or might be an Elbonian hacker trying to steal your bank acco
Re: (Score:2)
If we went to a CA model with the supervising CA demand rigorous security specifications and insta-revoke of CA keys if they go out of bounds, CAs would be useful.
Another good model would be going to a WOT system. I trust Verisign a lot more than I do an Elbonian CA. So, having a system where I mark that in my key database and that ends up on key servers will mitigate what a rogue CA can do even if their root cert is in browsers. However, exactly as you said, average users need to learn basic cryptograph
Re: (Score:2)
Bullshit. Router manufacturers could generate a CA cert, get it signed by a Trust Authority and then generate random certs for each device and sign them with their cert, which would be trusted because the trust works in a chain.
Hell, I did something like this not long ago, so this was just laziness and/or ignorance, not the fault of the browsers.
Re:The cost of CA-signing each key (Score:5, Informative)
This has zit to do with certification authorities, because the certificate would not be recognized as valid by any browser, because the DNS name would not match. And no certification authority worth their salt would sign a certificate for 10.0.0.1 or similar nonsense.
So, the solution would be D. generate a unique private/public key pair for each device, and have the user manually accept the certificate as an "exception" on first usage. Which he has to do anyways, even if all routers use the same certificate.
Moderators, please don't mod articles about certificates if you don't understand how certificates work.
Re: (Score:2)
the certificate would not be recognized as valid by any browser, because the DNS name would not match. And no certification authority worth their salt would sign a certificate for 10.0.0.1 or similar nonsense.
Which is why the built-in DNS server on e.g. NETGEAR routers points routerlogin.net to the appliance's private IP address.
Re: (Score:2)
Which is why the built-in DNS server on e.g. NETGEAR routers points routerlogin.net to the appliance's private IP address.
Smart...but it would have to be routerlogin.netgear.net or else no CA would sign this.
hmmm... but:
> dig routerlogin.netgear.net
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 25491
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 2, ADDITIONAL: 2
;; QUESTION SECTION:
;routerlogin.netgear.net. IN A
;; ANSWER SECTION:
; > DiG 9.7.1-P2-RedHat-9.7.1-2.P2.fc13 > routerlogin.netgear.net
routerlogin.netgear.net. 3531 IN A
Re: (Score:2)
Except Netgear owns netgear.com, not netgear.net..
Re: (Score:2)
rather than a router i could see this being used to compromise VPN concentrators and things of that manner - as then not only can you give your self access to other resources but at the same time you can skim more credentials than just the admin for that device - which would then allow you to get just about anywhere you want.
Re: (Score:2)
The scenario above is more likely to apply to SOHO, or to consumer wireless hardware in the home.
I must be buying the "good" devices, then, as every "SOHO" device I own that supports SSL allows you to upload a new key pair.
Seriously, we're talking about less than 4KB of flash memory to store the key pair...what recently-built device can't spare that much space?
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Even better than this. I'm at home. There is a single ethernet cable directly between my computer and my router.
This affects me how? It doesn't.
Beware! Could be a trojan. (Score:3)
I took a look at this LittleBlackBox tarball. It contains a lot of source code (sqlite, openssl, libpcap plus the the LittleBlackBox program itself which uses these libraries). I wouldn't trust any of the source code or the precompiled binaries. So that leaves you with a file called "lbb.db", which is an sqlite database. Get at that data in some other way (surely there are some sqlite tools for browsing databases or dumping them to text?)
I don't see the WRT54GL listed in there, nor Tomato firmware. Of cours
Re: (Score:3)
People who use the stock firmware on APs and other embedded devices will be using cryptography that is actually easily breakable, because these devices usually do not offer the option of regenerating a private key specific to the device (and even when they do, hasty consumers won't regen a key anyway.)
Re:Great Work! (Score:5, Insightful)
Re:Great Work! (Score:5, Insightful)
No, like most people who say that ... he only supports someone else's information being made public.
Re: (Score:2, Insightful)
There's a difference between exposing information about the misuse of power by a powerful individual or organization and information that only exposes a little person for abuse.
If absolutely all information wants to be free in some sci-fi quantum future, we'd better see to it
Re: (Score:2)
> If absolutely all information wants to be free...
Of course all information wants to be free. Just look how hard it struggles to get away and how expensive and difficult it is to keep it imprisoned.
Re: (Score:3)
Netgear, Belkin and the rest might deserve it but I don't. This is really lazy on the part of router manufacturers and I'm looking for a new one right now. Hopefully I can find one where the manufacturer doesn't suffer from a common sense failure.
Re: (Score:2)
It's trivial to configure an old pc or laptop as a home router. There are also "consumer" routers which can be converted to Open Source.
Re: (Score:2)
It's not my house or my router. The person who bought this router knows very little about the alleged triviality of configuring an old PC to be a router. I'm going to buy her another one but I shouldn't have to. I should be able to trust the router manufacturer. If my bank had such weak security and I had to find out about it on Slashdot would it be my fault or would it be the fault of the bank?
It's a nuanced case (Score:3)
So you'll have no problem posting all your passwords, social security number, bank account numbers, and so on publicly, then. Right?
This is one of the stock answers to the "information should be free" in copyright debates. The stock counter to that is that published credentials, such as passwords and the like, have little or no legitimate use other than to defraud people who do business with the rightful owner of the credentials. But this situation is far more nuanced than the typical use of this answer. Publishing an RSA private key almost sounds like publishing passwords, as an RSA key is a credential used to sign communication betwee
Re: (Score:2)
The stock counter to that is that published credentials, such as passwords and the like, have little or no legitimate use other than to defraud people who do business with the rightful owner of the credentials.
However, none of that information (passwords, social security number etc.) is likely to be within the scope of a copyright regime, and so, from a copyright point of view, is unlikely to be restricted. As such, someone publishing someone else's bank account number is unlikely to be infringing the
Re: (Score:2)
Re: (Score:2)
The AC is a straw man. Real "info wants to be free" people only want the info of companies, organizations, governments, etc. to be free. Julian Assange himself watches his own privacy very carefully [reuters.com].
Re: (Score:2)
"Information wants to be free". There's hardly a creed more often misinterpreted. Maybe aside of those associated with other religions.
The "information" that is meant here is not personal, privat information but information in the sense of "knowledge". Sharing knowledge can only lead to more knowledge, never less. If I know something you know, and you know something I know, we both know more than we knew before.
Re: (Score:2)
"A documentary about $controversial_topic". It's about as unbiased and fair as any documentary about abortion or creationism. Once you have people who have an agenda besides "documenting", don't bother watching it.
Re:Great Work! (Score:4, Insightful)
So you'll have no problem posting all your passwords, social security number, bank account numbers, and so on publicly, then. Right?
Not the same. This is more like calling the emperor naked. The bad guys already know that "security" is often just a theatre. This is just a blunt way to raise awareness of that fact and force vendors to start taking security more seriously.
Re: (Score:2)
Re: (Score:2)
I guess you have a choice. You can post supposedly private information ala Todd Davis and get some points for bravery. Or you can wait and see if someone does it for you showing clearly that you are an idiot for trusting your bank, wife, co-worker or whomever leaked the information.
Simple answer today: trust no one. Someone you trust will publish your secrets.
Re: (Score:2)
Either a strawman or just plain misunderstanding of the issues involved. Hanlon's razor suggests preferring the second option, so I will explain:
Information important to the public shouldn't be kept private.
The AC's passwords, accounts, etc. have no affect on the public and therefore should not be public information. The fact that your router's private key is cracked is a com
Re:Great Work! (Score:5, Insightful)
Information shouldn't be kept private
Re: (Score:2)
Sadly, I'm sure that very few if any hardware vendor will change their behavior after this breach of security. Caveat emptor.
Probably not.
Your average home use is never going to see this information. And if they do get bitten by it, they'll never know why or how.
The folks who are seeing this information are unlikely to be using these devices with stock firmware. And even if they are, they've probably taken measures to secure their network in other ways.
Re: (Score:2)
I have to use stock firmware. DD-WRT and OpenWRT have spent over a a year working on my type of router and there's still a good chance to brick it or burn out the wireless.
Re: (Score:2)
Buy a Linksys WRT54g v1-4 for $30 on Ebay. Flash it with DD-wrt and you're good to go. Is there a big feature of your router you're trying to keep (like N, gigabit lan or something)?
Re: (Score:2)
The ... nice person who thought it's smart to hardcode private keys.
Re: (Score:3)