• jqubed@lemmy.world
      17 days

      A security certificate authority from India had several of their keys deciphered because the numbers used to generate them were way too short. In fact one of them was simply the number 4. Because of this basically the entire internet has been put at risk because it’s trivially easy to forge keys from this trusted authority.

      https://www.theregister.com/security/2026/10/20/indian-certification-authority-emudhras-private-keys-compromised-one-of-them-was-the-number-4/5304312

    • Paulemeister@feddit.orgEnglish
      17 days

      As I understood it a certificate authority (the thing that you trust to make sure a website is who it claims it is) used 4 as the “password” for their cryptographic key, which would make it quite easy for a malicious attacker between you and a legit website, to modify the contents, encrypt it with their own key and then send their own certificate of, looking like it came from a certificate authority that you trust, essentially enabling an attacker to break encryption. (for example an ISP could do this as all the traffic goes through them)

      • libewa@feddit.org
        16 days

        It used 4 as the cryptographic key. (CA keys are not password protected afaik)

        • Paulemeister@feddit.orgEnglish
          16 days

          yeah I wasn’t sure if they have 4 as the key or 4 in some encoding. the key being straight up 4 is crazy

          • libewa@feddit.org
            16 days

            It’s base64 encoded along with some metadata, and cryptographically hashed so all keys are the same length.

    • Unleaded8163@fedia.io
      17 days

      Its the same joke everyone else is making.

      If you open the original post URL, there is an image with a post-it note reading “My password 4”. Some servers don’t show the post images sometimes, I had to open the original URL to see the picture.