Conversation

Notices

1. Embed this notice
   Pluto (pluto@chaos.social)'s status on Monday, 01-Jul-2024 16:33:01 JST Pluto

   in reply to

   If you don't want to be that guy who deleted the Windows, you can now be that guy who gave out all the Rocket.Chat communication to an attacker 😅

   `openssl req -new -x509 -nodes -out win.pem -keyout win.key -subj '/CN=Windows"? Do you want to keep your installation of "Windows'`

   • Embed this notice
     Pluto (pluto@chaos.social)'s status on Monday, 01-Jul-2024 16:33:03 JST Pluto

     In 2022, I discovered that this is how the Rocket.Chat Desktop apps handle invalid #TLS certificates. Pressing Enter sets the certificate as trusted, clicking "No" may present you with more and more prompts during which you cannot close the app.

     Please don't press Enter in Rocket.Chat Desktop #zeroday
     please boost!
     Here's my responsible disclosure story (bear with me, I'm not a security researcher) 🧵

     #infosec #opensource #security

     this.ven repeated this.