FreedomMoneyIsFuture on Nostr: "Anyone recovering these tiny private keys (d=4 etc on P-384) can forge trusted TLS ...
"Anyone recovering these tiny private keys (d=4 etc on P-384) can forge trusted TLS certs for any domain or code-sign malware.
Main use: MITM on unpatched systems—IoT, older Android/Linux, embedded devices, non-CT clients—that still trust the intermediates.
Browsers blocked them fast (Chrome/Firefox Oct 17). Scary for the long tail of devices that update slowly or never; low risk for modern updated software. No known prior abuse."
Published at
2026-10-21 18:33:57 UTCEvent JSON
{
"id": "b82600288662c4fbede3993359bc2f4c1096ccd0308d400ae0a367a92606d894",
"pubkey": "77f56243a824d22573fb755dd52c73c14986d15c0c98512d45f4deb08e9f879a",
"created_at": 1792607637,
"kind": 1,
"tags": [
[
"imeta",
"url https://i.postimg.cc/G2qb9zLz/Ian-Carroll-2.jpg",
"m image/jpeg",
"x 102df6e218669825cbda8774348f46602606c4995d450c3a33b2085318eb1771",
"size 33820",
"dim 607x455",
"blurhash D25}v^~qDhD$IA~q%2s:xuV@"
]
],
"content": "\"Anyone recovering these tiny private keys (d=4 etc on P-384) can forge trusted TLS certs for any domain or code-sign malware. \n\nMain use: MITM on unpatched systems—IoT, older Android/Linux, embedded devices, non-CT clients—that still trust the intermediates.\n\nBrowsers blocked them fast (Chrome/Firefox Oct 17). Scary for the long tail of devices that update slowly or never; low risk for modern updated software. No known prior abuse.\"\nhttps://i.postimg.cc/G2qb9zLz/Ian-Carroll-2.jpg",
"sig": "621810fd57d26d6c48e69844466e5b96f71144937edfdb1252e47c6a06778a256e5c8d2a32e0ef4f3699a61a5e9706cd3857ad8f78cf64bf04e2d50bd9ee8481"
}
