The anti AI scraping on this site doesn't work that well. I'm being served non-sense text about buttplugs. I'm human, I swear.
Muromec 56 minutes ago [-]
That was proof of soul check and you passed
hoherd 47 minutes ago [-]
The number the tool found was 1861. The e-mailed OTP code was 1858. What am I missing?
molticrystal 32 minutes ago [-]
I noticed that as well. Figured it was a concurrency issue, and they have a follow-up message that you can see if you click on the OP of the Mastodon thread that confirmed my guess: https://mastodon.catgirl.cloud/@49016/117476097901925573
>(yes the code is off by a few. its bc the poc is shit and to speed it up it uses 8 connections at the same time. it just stops the counter once it has a hit so its off by ~4 lmfao. you could easily fix this but cba today)
buildbot 56 minutes ago [-]
So basically anyone who used this CA is screwed if someone knows your email?
gruez 49 minutes ago [-]
Only if they're lazy and went with the "download key and certificate (and we'll generate the keys for you)" option. Otherwise at least how it's supposed to work is that you give a CA a certificate signing request (CSR) containing your public key, they sign it and hand back your certificate. The certificate itself doesn't contain anything sensitive, because it's the same thing that your server presents to clients. But people are lazy and might not know how to generate a csr locally, hence the aforementioned option. And of course if they're too lazy to generate a csr locally, they're probably also too lazy to keep backups, so you can be sure that eMudhra keeps a copy in case they deleted it from their downloads folder.
pdpi 9 minutes ago [-]
With this exploit, what's stopping me from sending my own CSR for your domain?
FLeXMurphy 1 hours ago [-]
Security represents less than 1% of their business.
lenerdenator 9 minutes ago [-]
Aye, but it'll now represent much, much more than 1% of their corporate reputation.
tommica 47 minutes ago [-]
Could someone explain this? Does this mean that it enables logging in as any account in emudhras infra?
cyberpunk 3 minutes ago [-]
Yes, it’s a complete auth bypass. All you need is the email address of a user and they’ll likely sign CSRs for any domains under that account.
It’s the end for them, I imagine.
cyberpunk 40 minutes ago [-]
Don't piss off the internet, there will be consequences. I guess.
VladVladikoff 48 minutes ago [-]
Hahahahha what a roast. Too funny, especially the "4 Bars" in the background of the demo.
gilrain 58 minutes ago [-]
This site serves me garbage. Iocaine, I think? I use Brave.
"If you are not [a bot], and you feel you have been served garbage by mistake, please contact the owner of the site you're visiting."
If anyone knows another way to access the content, I'd be interested. No contact details are offered and visiting mastodon.catgirl.cloud resets my connection.
You should be able to open the url in any other mastodon instance where you are signed in
bigfishrunning 19 minutes ago [-]
did not know it was a mastodon thing
sgsjchs 1 hours ago [-]
weak aura
codeduck 1 hours ago [-]
so use your phone?
OptionOfT 1 hours ago [-]
There was an post about something like this a while back on lobste.rs, where some people were upset about the image that Anubis shows while it is validating your machine.
_def 1 hours ago [-]
People are so uptight, it's embarassing
CodinM 1 hours ago [-]
I mean, they do accept money to give you a version without that.
Rendered at 20:57:42 GMT+0000 (UTC) with Wasmer Edge.
>(yes the code is off by a few. its bc the poc is shit and to speed it up it uses 8 connections at the same time. it just stops the counter once it has a hit so its off by ~4 lmfao. you could easily fix this but cba today)
It’s the end for them, I imagine.
"If you are not [a bot], and you feel you have been served garbage by mistake, please contact the owner of the site you're visiting."
If anyone knows another way to access the content, I'd be interested. No contact details are offered and visiting mastodon.catgirl.cloud resets my connection.