Public Key Cryptography

Blogger embeds protest message inside a valid TLS certificate's public key

A developer crafted a 'protest certificate' for maurycyz.com by choosing a private key whose resulting public key bytes spell out a readable ASCII message criticizing the SSL/TLS certificate system, then had it issued normally through Let's Encrypt. The post notes certificate authorities never verify that a submitted public key was generated from truly random data, citing a prior case where a CA issued a certificate using the trivial private key value '4'.

maurycyz.com · 2026-11-10

Researchers Catalog 39 Attack Techniques Targeting Passkey Systems

Security researchers, including work from SpecterOps, have documented at least 39 distinct methods that can undermine passkey authentication despite the underlying FIDO2 cryptography remaining secure. These techniques target the surrounding infrastructure rather than the cryptographic keys themselves, including browsers, operating systems, password managers, sync services, Bluetooth transport, and account recovery workflows. Many have working proof-of-concept tools, and some techniques are already surfacing in real-world attack activity.

bleepingcomputer.com · 2026-09-04