Twitter has an internal root CA problem

#1

Post by loriverkutya » Mon, Mar 13, 2023, 9:48 AM UTC

Twitter has an internal root CA problem
izzodlaw.com

Re: Twitter has an internal root CA problem

#2

Post by walrus01 » Mon, Mar 13, 2023, 10:21 AM UTC

very possibly bullshit but huge if true: https://twitter.com/davidgerard/status/1634633886712954881

Re: Twitter has an internal root CA problem

#3

Post by DrScientist » Mon, Mar 13, 2023, 10:30 AM UTC

If this is true - who knows - then it reflects rather badly on the people who were fired - as they didn't implement safeguard for a 'run over by a bus' scenario when they were in charge.

Re: Twitter has an internal root CA problem

#4

Post by zer0tonin » Mon, Mar 13, 2023, 10:31 AM UTC

DrScientist wrote: post #3

If this is true - who knows - then it reflects rather badly on the people who were fired - as they didn't implement safeguard for a 'run over by a bus' scenario when they were in charge.

There's "run over by a bus" and "90% of the company got ran over by a bus" scenarios. The second one is rarely worth implementing.

Re: Twitter has an internal root CA problem

#5

Post by raizer88 » Mon, Mar 13, 2023, 10:33 AM UTC

DrScientist wrote: post #3

If this is true - who knows - then it reflects rather badly on the people who were fired - as they didn't implement safeguard for a 'run over by a bus' scenario when they were in charge.

Maybe building it right cost 5x, and you have a budget for 1x. Sometime money is not unlimited even at FAANG

Re: Twitter has an internal root CA problem

#6

Post by fredoralive » Mon, Mar 13, 2023, 10:34 AM UTC

DrScientist wrote: post #3

If this is true - who knows - then it reflects rather badly on the people who were fired - as they didn't implement safeguard for a 'run over by a bus' scenario when they were in charge.

Or they had a "run over by a bus" scenario that assumed that the entire team wasn't going to be run over by a bus all at the same time?

Re: Twitter has an internal root CA problem

#7

Post by walrus01 » Mon, Mar 13, 2023, 10:35 AM UTC

zer0tonin wrote: post #4

DrScientist wrote: post #3

If this is true - who knows - then it reflects rather badly on the people who were fired - as they didn't implement safeguard for a 'run over by a bus' scenario when they were in charge.

There's "run over by a bus" and "90% of the company got ran over by a bus" scenarios. The second one is rarely worth implementing.

There's also possibility of: "If this person hadn't been fired, they could use some other form of credentials within twitter's internal systems plus a passphrase they have memorized to login to the private-key-repository system where the credentials for the root CA are stored and retrieve them. But as they were fired abruptly they are not inclined to help Musk. And nobody has asked them".

Re: Twitter has an internal root CA problem

#8

Post by jtvjan » Mon, Mar 13, 2023, 10:37 AM UTC

The certificate for Twitter's hidden service expired a full week ago and they still haven't exchanged it.

Re: Twitter has an internal root CA problem

#9

Post by 8organicbits » Mon, Mar 13, 2023, 10:45 AM UTC

I'll take the rumor with a grain of salt, but can anyone unpack what the recovery plan would be for something like this? It would obviously be a big problem, but where would you even start?

Re: Twitter has an internal root CA problem

#10

Post by jon-wood » Mon, Mar 13, 2023, 10:54 AM UTC

8organicbits wrote: post #9

I'll take the rumor with a grain of salt, but can anyone unpack what the recovery plan would be for something like this? It would obviously be a big problem, but where would you even start?

Assuming they’ve still got access to the servers themselves via SSH, you’d start by issuing a new root CA cert for the Puppetmaster and putting that in place, then you’ve got to issue a new cert for every client and distributing those. It’s not impossible, but it’s also going to be a pain in the backside to do.