An Indian Certificate Authority eMudhra was found to have a private key that’s literally the number 4. So using that you can sign valid https certs for anything that isn’t checking the revoked list.

▲

brendoelfrendo 3 hours ago | parent | next [-]

They had 8 intermediate certs with private keys under 1 byte (<256). The most egregious was 4, but any of those 8 were pitiful.

▲

bombcar 2 hours ago | parent [-]

It would’ve almost been better if the eight keys were just 1 2 3 4 5 6 7 8

	▲	mceachen an hour ago \| parent [-]
		That's the combination to my HSM!

▲

lifeisloving 2 hours ago | parent | prev [-]

Why is it important to you to mention they're indian in this context?

▲

Elsewhereindeed 43 minutes ago | parent | next [-]

Well it helped me understand the source of the strange flag.

▲

ButlerianJihad an hour ago | parent | prev [-]

For starters, they are not American, and this site has a predominantly American and European audience and participation.

Also, while I'm not sure what a "mudhra" is, I do know that mudra is a Hindu term for a sign or symbol made by the hands, for example the way an idol is posed in a temple. It's a form of sacred sign language.

Also, I am the kind of pessimist who goes through my device's root stores, and I "distrust" every root CA that I don't need to trust. This has never broken anything within my perception. I distrust the Turkey CAs, the Chinese communist CAs, the Indian CAs, and any other non-NATO sorts who have no reason to be serving any data to my devices.

* the compromised eMudhra certs were not root CAs but intermediates.

	▲	lifeisloving 10 minutes ago \| parent [-]
		Why do you call them chinese "communist" CAs. You right wing freaks are some of the dumbest people to ever live.