46 comments

[ 0.26 ms ] story [ 37.3 ms ] thread
Please can this not be true..
Security represents less than 1% of their business.
Aye, but it'll now represent much, much more than 1% of their corporate reputation.
The anti AI scraping on this site doesn't work that well. I'm being served non-sense text about buttplugs. I'm human, I swear.
that's actually the exploit, it was very physical
That's what comes after the verification can.
anti-AI scraping is often anti-privacy in practice, as any effective implementation requires invasive browser inspection to detect scrapers.
[delayed]
The web was always intended for both humans and machines.

- https://en.wikipedia.org/wiki/Semantic_Web

"Web 3.0" and "always" doesn't seem to align by any stretch.
Never thought I'd miss the days when block(chain)heads thought they had the rights to the term Web 3.0.
I got the same, on a residential internet service. No idea what the trigger is, worked on my phone though.
This site serves me garbage. Iocaine, I think? I use Brave.

"If you are not [a bot], and you feel you have been served garbage by mistake, please contact the owner of the site you're visiting."

If anyone knows another way to access the content, I'd be interested. No contact details are offered and visiting mastodon.catgirl.cloud resets my connection.

You can use https://github.com/jwilk/zygolophodon to read Mastodon posts in your terminal:

  $ zygolophodon --with-ancestors https://mastodon.catgirl.cloud/@49016/117475976434068995
Doesn't that also fetch the content directly? So depending on the logic of the filter it likely won't make any difference.
It uses the API, which hopefully is protected from bots less fiercely.
Ah yes, adopting the standard cloudflare approach. "Contact the site administrator to resolve this" but no contact details are provided.
So basically anyone who used this CA is screwed if someone knows your email?
Hahahahha what a roast. Too funny, especially the "4 Bars" in the background of the demo.
The number the tool found was 1861. The e-mailed OTP code was 1858. What am I missing?
I noticed that as well, figure it was a concurrency issue and they have a followup message that you can see if you click on the OP of the mastadon thread: https://mastodon.catgirl.cloud/@49016/117476097901925573

>(yes the code is off by a few. its bc the poc is shit and to speed it up it uses 8 connections at the same time. it just stops the counter once it has a hit so its off by ~4 lmfao. you could easily fix this but cba today)

Could someone explain this? Does this mean that it enables logging in as any account in emudhras infra?
Yes, it’s a complete auth bypass. All you need is the email address of a user and they’ll likely sign CSRs for any domains under that account.

It’s the end for them, I imagine.

Don't piss off the internet, there will be consequences. I guess.
"S" in "eMudhra stands for "Secure".
Oh man, good that they are leaving the CA business.

https://news.ycombinator.com/item?id=50195110

[delayed]
> Let's hope the powers up the chain conduct some deep self-refection on their part in thus fiasco.

that almost never happens.

stop hoping corporations grow a soul and a conscience.

> stop hoping corporations grow a soul and a conscience.

stop anthropomorphizing social constructs (corporations). corporations are run by humans. it is the humans running them that lack conscience and a soul.

In America, Corporations are people, too (for serious, see Citizens United SCOTUS ruling).

But corporately-suited Homo sapiens* should definitely be held criminally liable for much of their intentional shenanigans...

I always found it so interesting that corporations are essentially the outcome of we pay some people some money for them to work for the best interests of this entity that is not theirs. A lot arises from that.
I understand it in the following way:

They put the public key into js and encrypt the body of the request. This is common practice to protect users' important data from being accessed by a proxy (in this case, Cloudflare) and is ok.

But the real bug is that they don't rate-limit, invalidate, or protect the endpoint related to OTP checks, so it can be brute-forced, as the search space is limited.

Damn, these Mastodon accounts are a rabbit hole to get lost in
Cut the undersea cables already
I gave up cell phone service a few years ago (mid-sized USA city).

This seems less-and-less extreme, daily. Free yourselves from your leashes!

----

Next time you're standing in line, strike up conversation (about anything) with your ugliest linemate (it doesn't even matter about what, just offline communication)...

Maybe ya'll both like ZFS or "heard about that PHP thing!?" (I used both conversation starters, today – it worked – I can be the ugliest, too).

Please don't, not everyone appreciates small talk.
Please express this succinctly when talkers like me "get going" – I appreciate that not everybody wants these brief connections (you won't hurt my feelings with a simple "hey I'm not really much for talking").

If you prefer wordless silence, pulling out a phone (or book/magazine) works well when talkers "don't take the hint;" or face away (for particularly invasive conversation starters).

My hope is that small talk leads to shared connections, perhaps even (a brief intertwining of) humanity.

So everyone else should suffer because you don't want to politely decline?
I guess certs isn't the only thing they'll be exiting.