HackDig : Dig high-quality web security articles for hackers

Adobe accidentally leaked online its Private PGP Key

2017-09-25 16:35

The Adobe product security incident response team (PSIRT) accidentally published a private PGP key on its blog, once discovered the issue it quickly revoked it.

On Friday, the Adobe PSIRT updated its Pretty Good Privacy (PGP) key and published the new public key on the blog post. The new key should have been valid until September 2018, but something strange has happened. The security expert  Juho Nurminen first noted that scrolling down in the blog post containing there were present both public and private PGP keys.

In a PKI infrastructure, messages to be sent to the recipient are encrypted with the public key it has shared (in the Adobe case it was published in the blog post), and only the legitimate recipient can read it by using the associated private PGP key.

encryption PGP key

The accidental disclosure of the private key could have allowed anyone to decrypt encrypted email messages sent by the users to the company.

The Adobe PGP key was generated using Mailvelope, a popular open source browser extension for OpenPGP.

Mailvelope allows users to export either the public key, the private key, or both by selecting the “All” option. The Adobe employee who was exported the public PGP key likely selected the “All” option and copied the generated data without noticing it was sharing the private PGP key as well.

Adobe has promptly removed the blog post and revoked the compromised private key, but it was too late because it is still possible to find copy of the post online. Adobe has generated a new key pair, and this time avoiding using Mailvelope, but using GPGTools.

Pierluigi Paganini

(Security Affairs – PGP key, Adobe)

The post Adobe accidentally leaked online its Private PGP Key appeared first on Security Affairs.

Source: lmth.kael-yek-pgp-eboda/gnikcah/80436/sserpdrow/oc.sriaffaytiruces

Read:4407 | Comments:0 | Tags:Breaking News Digital ID Hacking Adobe data leak PGP PGP key

“Adobe accidentally leaked online its Private PGP Key”0 Comments

Submit A Comment



Blog :

Verification Code:


Share high-quality web security related articles with you:)


Tag Cloud