Light

Episode #1005 Quiz

Six-Day Certificates? Why?
Date: 2024-12-17 | Length: 2 hrs | Episode page at twit.tv

About this episode

This episode covers a critical vulnerability in Microsoft’s Azure MFA allowing brute-force bypass via parameter interception and lack of rate limiting, later remediated by strict throttling. It discusses Google's Android Bluetooth anti-tracking enhancements, North Korean IT worker cyber-espionage generating $88M, and open source supply chain threats with 540K malicious NPM packages.

Your name and email are stored only in your browser local storage for convenience. They are not retained server-side.

NameEmail

Question 1: What was the critical vulnerability discovered in Microsoft's Azure Multi-Factor Authentication (MFA) implementation as discussed in this episode?

Question 1

What was the critical vulnerability discovered in Microsoft's Azure Multi-Factor Authentication (MFA) implementation as discussed in this episode?

Microsoft's MFA system shared users' second-factor secrets with third-party apps without encryption. Microsoft used fixed, non-random secrets for TOTP generation, making codes predictable. The MFA codes were permanently valid without any expiration, allowing reuse indefinitely. The MFA system allowed brute-force guessing through multiple simultaneous connection attempts without rate limiting.

Question 2: According to this episode, what is the main reason Let's Encrypt plans to reduce their TLS certificate lifetime from 90 days to six days?

Question 2

According to this episode, what is the main reason Let's Encrypt plans to reduce their TLS certificate lifetime from 90 days to six days?

To force all websites to use more powerful encryption keys than the current 4096-bit keys. To increase profits by issuing 20 times more certificates with extra fees per certificate. To minimize exposure time during a key compromise event, thus improving TLS ecosystem security. To prevent the issuance of certificates without TPM 2.0 hardware on Windows 11 machines.

Question 3: What operational risk arises from nearly 500 million websites using six-day Let's Encrypt certificates as described in the episode?

Question 3

What operational risk arises from nearly 500 million websites using six-day Let's Encrypt certificates as described in the episode?

Users must manually renew certificates every six days, causing widespread service disruptions. Increased vulnerability to DNS poisoning attacks because short certificates do not verify domain ownership. A single point of failure on Let's Encrypt, where prolonged downtime would cause millions of sites' certificates to expire simultaneously. Browsers will reject six-day certificates due to incompatibility with CRLite revocation lists.

Question 4: What is the specific weakness in Microsoft's time-based MFA code expiration policy identified in the episode?

Question 4

What is the specific weakness in Microsoft's time-based MFA code expiration policy identified in the episode?

Not invalidating MFA codes until an explicit server-side request, allowing unlimited code reuse. Using MFA codes based on user IP addresses only, making codes predictable over time. Synchronizing MFA code expiration exactly to UTC time, causing timing mismatches for users in different time zones. Allowing six overlapping valid MFA codes simultaneously by keeping each code valid for three minutes.

Question 5: What new anti-tracking feature did Android introduce for Bluetooth trackers as per this episode's discussion?

Question 5

What new anti-tracking feature did Android introduce for Bluetooth trackers as per this episode's discussion?

An automatic alert for detecting unknown trackers moving with the user and a 'Find Nearby' feature to locate the tracker. Mandatory Bluetooth pairing requests before a device can broadcast any tracking identifiers. Complete disabling of all Bluetooth transmissions when the phone is not in use to prevent passive tracking. Encrypting all Bluetooth device names to prevent unauthorized detection and tracking.

Cancel

My Data//Security & Privacy//Clear Local Data

© 2026 Ken ArmstrongSecurity Now™ is a trademark of TWiT LLC. All trademarks and copyrights of the Security Now podcast are respected and reserved to their respective holders.
This is a hobby project made with love and admiration for what Steve Gibson and Leo Laporte have built over 20 years.