Apple has blocked eight web security certificates that could have been used by scammers to impersonate legitimate websites.

However, one cryptography engineer has warned that Macs may continue to trust the compromised certificates because macOS does not check for revocation …

The issue concerns what are known as intermediate certificates. These are used to prove ownership of a website, so if you visit apple.com, for example, Safari will check that you are visiting the real site.

However, an error in a script used to generate these certificates led to a number of private keys that could be trivially discovered by testing just 256 possible numbers. The eight compromised certificates have now been revoked, and steps taken to ensure that the vulnerability won’t affect any future certificates issued.

Bleeping Computer reports that Apple, Google and Mozilla have each blocked the compromised certificates in their respective web browsers.…