NHacker Next on Rails
  • top
  • new
  • best
  • ask
  • show
  • jobs
login
GuidelinesFAQListsAPISecurityLegalApply to YCContact

Hacker News on Rails, powered by React on Rails Pro. Open the source on GitHub by ShakaCode.

Commit 06fc0df

Rendered at 10:35:22 GMT+0000 (Coordinated Universal Time) with Rails + React on Rails RSC.

Indian CA's private keys compromised – one of them was the number '4' (theregister.com)

17 points by alwa 8h ago | 7 comments

dlcarrier 5h ago
I thought CAs automatically filtered out really low keys. There's a great Suckerpinch video (https://youtu.be/M1si1y5lvkk) about trying to purposely make the least secure HTTPS page possible, and Tom initially tried to choose a laughably-low number as the key, but the CA automatically rejected it.
pwfisher 7h ago
Test your browser and update your system's certificates: https://emudhra.we-have-a-problem.com/
unsupp0rted 7h ago
Never attribute to malice what can be explained by ignorance?

In this case I wonder if this was an intentional wide open doorway to fraud

MiroslavPokorny 7h ago
This wasnt malice its was laziness.

They literally were too lazy to type more than just a single '4'.

unsupp0rted 4h ago
Either that or they intentionally wanted to create a publicly-accessible backdoor, with plausible deniability of laziness
alwa 8h ago
Bugzilla bug in question:

https://.mozilla.org/showbug.cgi?id=2083449

LoganDark 7h ago
https://bugzilla.mozilla.org/show_bug.cgi?id=2083449