- cross-posted to:
- programmer_humor@programming.dev
- cross-posted to:
- programmer_humor@programming.dev
You must log in or register to comment.
Wait a minute… There’s something bothering me about this place…
I’m using PHP 4
is that what this is about
all the fuss
What’s this a reference to?
It was discovered that one of India’s Trusted Certificate Authorities, eMudhra, tasked with signing website certificates to verify authenticity of HTTP traffic was using the number “4” as the signing key along with 7 other keys less than 250. The key is supposed to be a unique number hundreds of binary digits long, but with such a simple key anybody can spoof a certificate that they could claim was signed by eMudhra and CA-checking lists would accept that.
At least use a GUID generator website to generate it like the rest of us.
Nerd alert!
You got a lot of downvote for this, lol.
4 has been breached. Update your browsers! We are using 5 now :)
I’m using 8. It’s twice as secure
We can’t afford the computational overhead of 8! Help plz
How do I begin? Basically, an India based company that does TLS certification published some comically bad private keys. One of which was just the character 4. Update all of your browsers btw, desktop and mobile. This is a very major low level security breech of the entire internet.
It may take Linux distros days to patch it, and this includes millions of servers.
An ssl certificate provider used 4 as their private key. This should be hundreds of characters long. Somebody figured this out and was able to issue their own certificates based on it. This results in loss of trust in their certificates which is a big deal.
It is compared as bigger than one of the largest security issues in IT the last couple of years since it forces everybody to patch their shit to not trust this certificate chain. And lots of stuff aren’t patched that easily.
I bet they used 0000000000…004
See, hundreds of digits long!
I mean …. Yes, that would be secure.
Sorta.
It’s be dumb, and a pattern based attack could potentially solve it easily … but technically much more secure than
4I get what you mean, but no, it would not be secure. The private key in question is really used as a number in a calculation, not as a string of digits. Leading zeroes would just be ignored.
not when it’s a representation of bits in a file
The key itself being 00000000004 yah
The key file being
0000000000000000000000……4 is a different story
4
eMudhra, an Indian tech firm, had a root TLS cert with laughably low size for one of its encryption keys https://scotthelme.co.uk/eight-bits-of-trust-emudhras-ca-keys-cracked-in-milliseconds/
A company from India was issuing Internet security certificates with extremely small private keys. The lowest they issued was 4
Reminds me of the scene in Space Balls, where the passcode to a planet‘s atmosphere protection is revealed to the villan amd it‘s just
1234. … except this is arguably worse.Wasn’t it 12345? And the same code as the president’s luggage?
No, it was 4. The same as the nuclear code.
Yes it was
12345in the movie. I forgor… so maybe it is safe.
The entire world’s data VS the entire world’s air.
Four, four, four, four, four
Skate
Four
Skate
(Look I got the reference)
I’m using 11111
Ironically all the numbers in this meme would’ve made for a better private key.
