I'm still not ok with all of yesterday... but it is completely out of my hands...
... and, honestly, that's why it's freaking me out, so much.
It doesn't matter how secure I make passwords, or how reluctant I am to sign up for anything, or how honestly small my personal-use internet is...
If the folks controlling those sites are using backdoor control passwords of "4"...
... then all the locks in the world that I put on it won't do a damn thing on a door made of paper.
... and as someone who struggles with paranoia and anxiety... that's terrifying.
@JulieSqveakaroo for what it's worth, the stuff yesterday would not have allowed anyone to get your passwords or anything
the emudhra thing just means that it's trivial to make a device think your website is what it claims to be, so it can be used to make malicious sites that your computer thinks are secure or to send updates to iot devices from someone other than the manufacturer, but it won't let them access the passwords or any encrypted data on its own
-F
@JulieSqveakaroo although i'm less sure about the php exploit but it also shouldn't make it possible to decrypt encrypted data without the key
-F
@JulieSqveakaroo (the emudhra thing is encryption related but it is for securing specific things, not user data)
-F
@Hearth @JulieSqveakaroo Probably the best way to describe it is protection against counterfeiting and impersonation.
It's an ID card a website shows your browser, not a key you fish out and use.
@arielmt @Hearth @JulieSqveakaroo and, specifically, your computer has to be tricked to go to a wrong server in a fairly elaborate fashion. It's more a concern on fake public WiFi than at home by far.
If anything, I'd say to take heart in the strong response. Folks managing systems that would be affected very rapidly to resolve the potential concerns.
@arielmt @JulieSqveakaroo yeah exactly
and because of this problem we now have a way of generating new ID cards that will be accepted by devices that haven't been updated (so this is quite possibly an in-road for hacking/jailbreaking more devices) but that still doesn't get them a copy of your key
-F