https://arstechnica.com/information-technology/2018/03/trustico-website-goes-dark-after-someone-drops-critical-flaw-on-twitter/?comments=1&post=34905947&mode=quote
https://mobile.twitter.com/Manawyrm/status/969230542578348033
Oh putain il y a du rab ! :blobaww: #trustico #infosys #securité #ssl #certificate
#trustico #infosys #securité #ssl #certificate
https://pony.social/media/BqAnFzwVM_wWxo9L2eI
I found #trustico 's secret stash!
GET YOUR POPCORN READY #digicert #trustico https://www.mail-archive.com/dev-security-policy@lists.mozilla.org/msg09397.html
My guess is #trustico's server side generated private keys were permanently stored, badly secured and have now been compromised. I wonder how many lazy admins of large websites used this service.
So #trustico sent 23k private keys to DigiCert to get the corresponding certificates revoked. I wonder where they got the private keys from? 🤪