Current event posts about an upstream computer security cert that ended up just being the number four (and others from the same company that were low numbers). Initial the post.
This is about compromised eMudhra intermediate TLS certificates. They were found to have weak private keys - eg. “4”, instead of a normal 116 character key. Major Internet panic for browsers and server admins.
I'm dumb so this is probably more than half wrong, but they discovered a trusted certificate certifier in the middle east publishing dangerously unsafe passkeys. One of which was attached to a sight titled "We've got a problem Dave." Or something with a passkey of 4. Which means for an unknown time most Internet security was bypassed without our knowledge. As far as I'm aware there isn't evidence of someone successfully using the exploit but it's so dangerous that a small chunk of the Internet was completely locked down and things like Linux and many home electronics will be hit more than most.
Uhm, yeah more than half wrong…
An indian certificate authority had produced a set of faulty certificates with private keys between three and eight bits long, when the standard is 384 bits. There is no malicious reason to do this, it was likely incompetence. The effect is that these certificates are trivially easy to reverse-engineer, meaning a bad actor could use them to sign certificates for any web domain, defeating the protection TLS provides against man-in-the-middle attacks. The certificates have already been marked as un-trustworthy on all major web browsers and operating systems, the risk lies with devices that do not get regular updates.
Edit: additionally, we know exactly when these faulty certificates were made and thus we also know for how long they have been exploitable
No malicious reason to do this he says, while Modi's coalition or at least the money behind it was known for having backdoor access to all their enemies somehow
14 replies
This is why state-of-the-art 24th-century starships get hacked in seconds by aliens who have never even seen the platform or software before.
They usually abduct a disabled crew member and use his meta glasses.
They should at least make a 2-factor self-destruct login like: "insert your personal pet-tribble here"
Tbf it was all 2fa x3 with a final code
Yeah... It's a 384 bits key, so there some 150 zeros there in front of the four.
This isn't a comment on the meme I just love the lighting in these shots
is this a current event post or is 4 the new beans
Current event posts about an upstream computer security cert that ended up just being the number four (and others from the same company that were low numbers). Initial the post.
This is about compromised eMudhra intermediate TLS certificates. They were found to have weak private keys - eg. “4”, instead of a normal 116 character key. Major Internet panic for browsers and server admins.
Yup, and then the PHP vulnerability came out and eclipsed that on the "oh shit" scale
I'm dumb so this is probably more than half wrong, but they discovered a trusted certificate certifier in the middle east publishing dangerously unsafe passkeys. One of which was attached to a sight titled "We've got a problem Dave." Or something with a passkey of 4. Which means for an unknown time most Internet security was bypassed without our knowledge. As far as I'm aware there isn't evidence of someone successfully using the exploit but it's so dangerous that a small chunk of the Internet was completely locked down and things like Linux and many home electronics will be hit more than most.
Uhm, yeah more than half wrong… An indian certificate authority had produced a set of faulty certificates with private keys between three and eight bits long, when the standard is 384 bits. There is no malicious reason to do this, it was likely incompetence. The effect is that these certificates are trivially easy to reverse-engineer, meaning a bad actor could use them to sign certificates for any web domain, defeating the protection TLS provides against man-in-the-middle attacks. The certificates have already been marked as un-trustworthy on all major web browsers and operating systems, the risk lies with devices that do not get regular updates.
Edit: additionally, we know exactly when these faulty certificates were made and thus we also know for how long they have been exploitable
No malicious reason to do this he says, while Modi's coalition or at least the money behind it was known for having backdoor access to all their enemies somehow
You don’t need shitty private keys to do that, if you control the key gen you can just copy the not-shitty private keys