News for hackers. Stuff that matters.

A comment on Instagram's Million Dollar Bug. Parent comment

Re:Instagram's Million Dollar Bug by bigiain on Thursday December 17, 2015 @06:36PM (#10755514)
According to the timeline, Instagram have known about the ssl keys since 1 Dec.

My browser is currently showing an ssl cert for instagram.com that was issued in April and expires on Dec 31.

Doesn't look like they're in any hurry to revoke that one. (I guess like Alex Stamos told his employer - it's "trivial and of little value"...)

[ Parent | on HN ]
Re:Instagram's Million Dollar Bug by eropple on Thursday December 17, 2015 @08:04PM (#10755918)
Or, like almost any company that's reasonably competent, they have multiple certificates with different private keys.
[ Parent | on HN ]
Re:Instagram's Million Dollar Bug by bigiain on Thursday December 17, 2015 @08:08PM (#10755936)
And they just happen to only leave some of them in their S3 buckets?

Seems … contradictory.

[ Parent | on HN ]