Re:Instagram's Million Dollar Bug
by Cakez0r on Thursday December 17, 2015 @06:17PM
(#10755405)
Surely they would have to revoke all the keys anyway as they would have no idea if a blackhat got their first and took the keys before the vulnerability was reported?
[ Parent
| on HN ]
According to the timeline, Instagram have known about the ssl keys since 1 Dec.
My browser is currently showing an ssl cert for instagram.com that was issued in April and expires on Dec 31.
Doesn't look like they're in any hurry to revoke that one. (I guess like Alex Stamos told his employer - it's "trivial and of little value"...)
Or, like almost any company that's reasonably competent, they have multiple certificates with different private keys.