Hacker News Reader

Comment by jiggawatts | Hacker News Reader

Perfectly understandable, at that age I only had the vaguest notion of how cryptography works.

Unfortunately, nobody else seems to either, which is why my comment is getting downvoted.

"Why is this a problem?" say people when the publishing of a private key is inherently the wrong thing to do, and will always lead to a bad consequence.

It doesn't matter who's key it is, how it was generated, how it was obtained, etc...

The purpose of private keys is to be kept secret. A published private key by definition is worthless. That will have a consequence. Either it'll be make-believe fairytale security, or someone else getting into your product, or what happened here: the third party who's keys were stolen changed the locks.

Meanwhile I'm at -4 and clocking down because people struggle to understand how keys and locks work, never mind cryptography.

View on HN

I believe users are downvoting your comments because they are breaking the site guidelines. If you wouldn't mind reviewing https://news.ycombinator.com/newsguidelines.html and posting more in the intended spirit, we'd appreciate it, and your comments should get fewer downvotes too. See also https://news.ycombinator.com/item?id=38579013.

The repo is a proof of concept. The key provided is used for illustration purposes and worked for the proof of concept. Nobody believes Apple would not revoke that key. But you don't need to talk down to the author for their age like this when they've made clear this is a proof of concept.

Your understanding in of cryptography appears to be "private means private"

> A published private key by definition is worthless.

If I publish the AACS _private_ key, is it now worthless?

Yes! It becomes worthless for copy protection.

Public-private key pairs only work if the private key is secret. If it’s not secret it doesn’t work.

This is a simple fact of how cryptography works. Or passwords, keys, or any secret like an API key, etc…

If you publish such things on GitHub, they instantly become “not what you’ve labelled it as”.

> It becomes worthless for...

So you admit it's not completely worthless at that point only for specific use cases.

Sure, it has uses: it can be printed on a T-shirt to teach big media a lesson about the futility of copy protection, etc…

Plus it lets people decrypt media encrypted by that key that they might otherwise have been unable to.

So we've established that a "private key" that is no longer private may still have uses to some people, it is not wholly "worthless."

Do you want to revise your earlier statement about the private key in the repo in question? Is it "worthless"? Is it a security problem? Do you know what that key is being used for?

Reply on news.ycombinator.com