That has no effect, since the'd get no such business from now.
What's sad it they won't be taking their certs with them. Let's hope the powers up the chain conduct some deep self-refection on their part in thus fiasco.
I noticed that as well. Figured it was a concurrency issue, and they have a follow-up message that you can see if you click on the OP of the Mastodon thread that confirmed my guess: https://mastodon.catgirl.cloud/@49016/117476097901925573
>(yes the code is off by a few. its bc the poc is shit and to speed it up it uses 8 connections at the same time. it just stops the counter once it has a hit so its off by ~4 lmfao. you could easily fix this but cba today)
Only if they're lazy and went with the "download key and certificate (and we'll generate the keys for you)" option. Otherwise at least how it's supposed to work is that you give a CA a certificate signing request (CSR) containing your public key, they sign it and hand back your certificate. The certificate itself doesn't contain anything sensitive, because it's the same thing that your server presents to clients. But people are lazy and might not know how to generate a csr locally, hence the aforementioned option. And of course if they're too lazy to generate a csr locally, they're probably also too lazy to keep backups, so you can be sure that eMudhra keeps a copy in case they deleted it from their downloads folder.
They put the public key into js and encrypt the body of the request. This is common practice to protect users' important data from being accessed by a proxy (in this case, Cloudflare) and is ok.
But the real bug is that they don't rate-limit, invalidate, or protect the endpoint related to OTP checks, so it can be brute-forced, as the search space is limited.
This site serves me garbage. Iocaine, I think? I use Brave.
"If you are not [a bot], and you feel you have been served garbage by mistake, please contact the owner of the site you're visiting."
If anyone knows another way to access the content, I'd be interested. No contact details are offered and visiting mastodon.catgirl.cloud resets my connection.
There was an post about something like this a while back on lobste.rs, where some people were upset about the image that Anubis shows while it is validating your machine.
https://news.ycombinator.com/item?id=50195110
What's sad it they won't be taking their certs with them. Let's hope the powers up the chain conduct some deep self-refection on their part in thus fiasco.
that almost never happens.
stop hoping corporations grow a soul and a conscience.
>(yes the code is off by a few. its bc the poc is shit and to speed it up it uses 8 connections at the same time. it just stops the counter once it has a hit so its off by ~4 lmfao. you could easily fix this but cba today)
They put the public key into js and encrypt the body of the request. This is common practice to protect users' important data from being accessed by a proxy (in this case, Cloudflare) and is ok.
But the real bug is that they don't rate-limit, invalidate, or protect the endpoint related to OTP checks, so it can be brute-forced, as the search space is limited.
It’s the end for them, I imagine.
Actual security, add some zeros ;)
"If you are not [a bot], and you feel you have been served garbage by mistake, please contact the owner of the site you're visiting."
If anyone knows another way to access the content, I'd be interested. No contact details are offered and visiting mastodon.catgirl.cloud resets my connection.