Rendered at 16:20:30 GMT+0000 (Coordinated Universal Time) with Cloudflare Workers.
Confiks 15 hours ago [-]
It's almost a shame it includes the private key and doesn't bruteforce it in-band for every request.
cyphar 14 hours ago [-]
I wonder if more CPU cycles would be spent in the transporting and other ancillary operations (hashing and signing) than would be spent if they "brute-forced" it. Crazy.
I took the parent's comment to mean "brutal" as in an absolute burn/roast.
brirec 14 hours ago [-]
Thanks, sometimes I miss things…
nostrademons 13 hours ago [-]
They could just write the function bruteForceEMudhraKey() { return 4; }.
taneq 14 hours ago [-]
Guaranteed random, chosen by fair roll of a die.
(Credit to the relevant xkcd. :D )
hdjdnxjzhzhs 9 hours ago [-]
Funnily enough that xkcd was created because Debian actually had a hardcoded random variable (the variable should have been randomly generated) ... It was noticed when certs/pub keys for different websites were coming up the same... Mind you this was close to A quarter century ago ....
tialaramex 4 hours ago [-]
You've misremembered, but it's worth me re-explaining this because lots of people even at the time tended to describe the mistake incorrectly.
Here's how the famous "Debian Weak Keys" come into existence:
OpenSSL had two buffers we care about here for generating random keys, with associated code to mix from those buffers into the data that's going to finally be used to produce cryptographically random numbers, lets call these bufferA, bufferB and mixA, mixB
In some cases bufferA is intialized by reading data from somewhere, in other cases it was never initialized. So mixA is doing uninitialized reads in those other cases. OpenSSL is written in C and in principle reading uninitialized data is Undefined Behaviour in C, but in practice nothing terrible happened here, you'd probably get zeroes, in some cases maybe unrelated trash. However, tools for spotting UB in your C library kept flagging mixA, which read this uninitialized data, as a problem.
bufferB is always crucial, if this isn't used the numbers won't be very random at all. This data is always initialized. But mixB is very similar code to mixA, after all it is doing similar work.
OpenSSL had rejected work to "fix" the mixA uninitialized bug but a Debian developer decided that it was too annoying so they patched mixA out. If that had been the whole story nothing terrible happens and nobody would remember today. However since mixB is similar, that Debian developer asked the OpenSSL developer list hey, is it OK to patch out mixB too?
And the developers said it was OK. The result is that Debian shipped OpenSSL which did not actually generate truly random keys. There were some number (thousands?) likely and of those a handful were especially most likely to be picked, based on exactly how soon after system start you wanted to make some keys with OpenSSL.
Now, after this blew up those developers said they thought the question was about testing. And IIRC it was possible to look at the same email and, if you know mixB is crucial, you think obviously they just want to test that their change does what they expected, nobody would patch out mixB in production, that's crazy. But the developer who wrote the email intended a different meaning, they really did mean to patch out mixB and were asking if that's OK.
notrustincloud 2 hours ago [-]
Thank you for that trip back into a very dark corner of my memory. I had almost forgotten the whole circus of it all; right about then i was working in the hardware 'nearly true RNG' and had this whole can of worms happen right in the middle of an otherwise working setup. What fun.
That's as clear an explanation about the situation as I have ever read. I don't know the occasion to need to explain it to anyone else will arise, but when it does... or I may use it as example of the consequences of shallow communication when serious outcomes may arise. (Ill be sure to credit the source 'tialaramex' on HN)
Train driver and signaller both believe they've reached the same understanding of the situation, but their understanding actually remains divergent, and the driver (plus a MOM) nearly gets killed as a result.
soneil 9 hours ago [-]
I've seen this mentioned a few times over the last day or two, but it's not true.
The xkcd was 2007 [0], the Debian issue was 2008 [1].
It was used in pretty much every blogpost describing the Debian issue, but it wasn't created because of the Debian issue (unless they gave Randall an 8-month head-start before disclosing it).
(I don't mean this as a "well akshully" - but for me it's more impressive that it's a truism that keeps coming true, than if it was just a swipe at them in the first place)
This looks like it's using the emSign root path, which is useful, but the AAA root path is equally useful in different cases. The AAA root path was disabled for https on root stores newer than February 2025, but has been in root stores since forever. Meanwhile the emSign root path was only included in root stores since ~2018 and got removed in October 2026.
So from the perspective of hacking old IoT devices, if your device hasn't been updated since 2018, the AAA path should work; if since February 2025, either path works; if since October 2026, the emSign path.
There is an MR to add the AAA root path open to allow picking either one.
shrubble 16 hours ago [-]
If I’m understanding correctly, you could sniff the communication between your Smart TV and the manufacturer using this method?
the_snooze 16 hours ago [-]
As long as the smart TV still trusts eMudhra, then yeah. You'll want to super careful and prevent the TV from pulling updates that could revoke that trust.
sidewndr46 4 hours ago [-]
the word 'trust' is doing lots of work in this sentence.
scraptkid 1 hours ago [-]
I just tried with my older Samsung TV and SOME https request content appears to be readable, but not all
kevin_nisbet 16 hours ago [-]
Possibly. But some manufacturers may not have the full set of roots, use a private authority, or do certificate pinning.
ce4 10 hours ago [-]
The Emudhra intermediates were cross signed by Sectigo.
IanCal 6 hours ago [-]
I feel like this is one of the blunders that would feel worse if it wasn't so stupid and broad, it's at a point that feels comical.
Xiol 10 hours ago [-]
LG must be bricking it.
quotemstr 16 hours ago [-]
If the TV isn't older than a few years, if it's not checking CRLs, and if it hasn't yet patched itself.
thayne 13 hours ago [-]
> if it's not checking CRLs
I would be amazed to see a TV that is checking CRLs and keeps the CRLs up to date.
lloeki 10 hours ago [-]
The lengths they would go to prevent you from snooping at them.
moduspol 1 hours ago [-]
And if it's not using its own trust store, which I wouldn't expect from TVs, but would potentially expect with more competent or security focused electronics.
The "8 bit" part comes from how, of their 8 private keys discovered to be extremely weak, all fit the pattern of a random 8 bit number. The highest of the group was 237 and the lowest was 4.
seniorsassycat 16 hours ago [-]
How much of a boon is this for jailbreaking, reverse engineering, and mitm really?
himata4113 15 hours ago [-]
client on startup asks: hey server do you have any ads for me
server: here are latest ads
btw, the ads are capable of code execution for whatever reason so now you have an RCE on your hands for your client
bryancoxwell 15 hours ago [-]
Been wondering this as well. I also don’t really understand the mitm to jailbreak pipeline
flexagoon 15 hours ago [-]
Some smart devices pull config files from a server. By mitming that, you can change the config to enable some sort of developer mode on the device.
qwertyforce 15 hours ago [-]
Maybe intercept firmware update and then reverse engineer it and find rce?
mrheosuper 14 hours ago [-]
The fw could be encrypted
ruined 14 hours ago [-]
military grade SSL
edoceo 14 hours ago [-]
Seed is '123456', much more random than '4'
tclancy 5 hours ago [-]
Remind me to change my luggage combination.
closetheloopdev 15 hours ago [-]
I created a proxy using the 6 compromised eMudhra CA keys (2 of the 8 are code-signing and not for TLS). I initially tried just one (the one with d=4) like in the commit, but it did not seem to work for anything. Once I added all 6 keys, I was able to intercept some.
I was mainly interested in testing which IoT devices are affected and protecting them, not trying to sniff their traffic since it's been a long day. My proxy thus just intercepted and forwarded the traffic upstream using a fresh TLS connection that does not use the compromised keys.
cherioo 15 hours ago [-]
I thought this cert only recently gets trusted, so only newish but not too new devices would be vulnerable. Am i misunderstanding how this works?
SAI_Peregrinus 14 hours ago [-]
The flaw is egregious enough that the root cert which signed them (emSign ECC Root CA – G3) is getting removed from trust stores. We know 8 ridiculously weak keys got made, but we don't know that 0 slightly less weak but still unacceptable keys got made. What if they issued a CA key with 80 bits of entropy? That's enough that brute force would take more time than it's been since the disclosure, but not so long that they'd be considered at all secure (they should have 384 bits of entropy). So everything that root signed is untrustworthy, possibly everything the CA has signed. The G3 root is from 2018 IIRC, so lots of potentially exposed devices.
dullcrisp 13 hours ago [-]
80 bits couldn’t be guessed with modern technology right? That’s still a bigger number than I know a name for. (Or I guess a trillion trillion. Maybe if we stopped building AI and just used all the data centers for this we could guess it eventually?)
murderfs 13 hours ago [-]
Elliptic curves can be broken with 2^(n/2) steps, so you could probably do it on a single GPU within a day.
This is gonna be great to sniff apps in a couple older Android phones I have around. Hope they're not pinning certificates.
cedws 10 hours ago [-]
Most interesting stuff is pinned unfortunately.
gkbrk 9 hours ago [-]
Frida can usually un-pin those pretty easily.
cedws 9 hours ago [-]
The apps I've been interested in have attestation and reverse engineering countermeasures that block Frida.
selcuka 15 hours ago [-]
Can't you install your own CA to Android phones?
j027 14 hours ago [-]
You can, but since android 7 IIRC apps don’t trust the user store by default (unless you have root and add it to the system store or patch the app to trust the user store)
hollow-moe 6 hours ago [-]
So, I've been wondering : Is the number 4 now an illegal number ?
Possession could indicate that you are part of a criminal conspiracy, yes.
zetazzed 12 hours ago [-]
Does anyone know what is happening to the company eMudhra? Are they being sued into oblivion? Taken over by Indian government? Or just doing business still?
maratc 6 hours ago [-]
> sued into oblivion
Being bad at choosing random numbers is not a crime, I am afraid.
I can imagine them being sued for "securities fraud" (as Matt Levine suggests) but only if they were a US publicly traded company.
angott 12 hours ago [-]
Their stock is down 30.5% compared with Monday's closing price.
gmerc 12 hours ago [-]
Time to buy. Think about it like Crowdstrike
bauruine 10 hours ago [-]
It's not unlikely they get all their certs revoked.
gmerc 12 hours ago [-]
They are an oligarch business. What would happen if X had this fuckup in the Us is the easiest way to answer all your questions l. Nothing will happen.
xlayn 14 hours ago [-]
the "security" in those certificates where so trivial, that almost looks like on purpose as backdoor...
which brings me to my next question, what if you rerun the same process for all the certificates in the "approved" stores, give them 1 min per certificate.. just to see how many other CAs are being "friendly" to parties that could take benefit of that...
update... I'm talking out of ignorance here... but assuming cli open source tools, should they prevent you creating certificates with weak settings unless --emudhra-level-security is passed?
also, what amount of time is needed in say a "civilian" gpu with claude to vibe code something that can test a certificate so say 80 bits.. or whatever is the level where yes, you cannot find the values to generate the certificate with a cpu... but you can with a gpu in say 1 day? say it's 80 bits... how many CA stores are there? how much does it cost to rent gpus to run in parallel to test 1 day of civilian gpu to check each certificate if you use one of these very expensive ones?
Hobadee 13 hours ago [-]
Why would you need to insert a "backdoor" in a cert in the form of a crappy key, when you could just use a real key and provide it to whatever shady organization requested the backdoor in the first place?
sidewndr46 4 hours ago [-]
plausible deniability. If your key can be brute forced and your intermediate CA is used by some bad actor, you can just say they brute forced it.
Hobadee 3 hours ago [-]
That has extremely high potential for strong reputational damage though. (As we see in this case)
Versus: "The government ordered us to give them the keys and forced us to remain silent about it" - now all the damage lies on the government, who is likely known to already do stuff like that (or at least it isn't a surprise) and will hide behind the banner of safety or national security or something. (Whether it's true or not)
sidewndr46 2 hours ago [-]
Sure, but the person who created these weak keys resigned not long after their crypto payment cleared. They took their money & left the country.
> what amount of time is needed in say a "civilian" gpu
Per AI, 10²¹ years
Alternatively I would presume you could do it in 1 year with 10²¹ GPUs.
chrisweekly 12 hours ago [-]
mitmproxy is an amazing cli powertool I first discovered over a decade ago (around the same time as lnav). highly recommended.
totetsu 10 hours ago [-]
It has come to save the day on so many occasions.
isolay 2 hours ago [-]
Is eMudhra the sister of Cthulhu by any chance?
wildmXranat 16 hours ago [-]
Someone should've coined this disaster as "QuattroFail" to give it a little panache and international mystery
gnabgib 16 hours ago [-]
"4" was only some of the keys (they were all <256).. ByteFail seems more accurate
bombcar 14 hours ago [-]
OneByteWonder
jaggederest 14 hours ago [-]
but they were all deceived... in the darkness of a key-signing ceremony, another cert was signed. One byte to rule them all, and in the darkness MITM them.
0xfab1 12 hours ago [-]
Byte-sized Quiche
mintflow 16 hours ago [-]
Haha, this is quite interesting to test if you need to update various of program (if they do not use the sys ca chain)
lambda 15 hours ago [-]
Oh, nice. I was thinking of setting up a proxy for this for testing, nice to just have it working out of the box.
scotty79 13 hours ago [-]
There should be one week CA by design. To facilitate such proxying.
rlt 12 hours ago [-]
This a joke, right? RIGHT?!
imp0cat 9 hours ago [-]
Right. There definitely needs to be more than one. ;)
skeledrew 16 hours ago [-]
This is how fame happens.
maxlin 15 hours ago [-]
infamy*
xp84 14 hours ago [-]
They deserve every bit of it. Their name will be a synonym for sloppy security. "Oh shit, you got Emudhra'd"
thayne 12 hours ago [-]
> They deserve every bit of it
I think they deserve more than 8 bits of infamy.
DonHopkins 5 hours ago [-]
[flagged]
akimbostrawman 5 hours ago [-]
Thanks for hilariously off topic and deranged reply. If you haven't noticed it's not 2020 anymore and ESG funding is drying up which Bioware had to experience first hand just yesterday with being shutdown by EA just like Maxis before ;)
DonHopkins 5 hours ago [-]
It's not anything but 2026 anymore, but GamerGate happened in 2014, even though The Sims proved it wrong in 2000.
Yet you and maxlin are still clinging to and defending its bigoted long disproven ideas, as if it's core to your personality.
So you're the deranged out of touch ones, decades behind the times, and on the wrong side of history, unable to counter my arguments or EA's $5 billion in sales with any evidence at all. You're just bigoted GamerGate armchair vibe game designers, with lots of hot air but nothing to show.
Edit: Your "slandering innocent people into suicide" is pure psychological projection from a bigot defending doxing and harassing women.
Thanks for proving my point by pulling evidence-free hallucinations and vibes out of your ass that can't counter $5 billion of evidence you're wrong.
Actually it was $5 billion 7 years ago, and a lot more now. So name a more successful homophobic anti-woke title.
>Legacy:
The success of The Sims has resulted in Guinness World Records awarding the series numerous world records, including, as of 2017, "Most Expansion Packs for a Videogame Series" and "Best Selling PC Game Series", with sales estimates ranging from 36 to 50 million units. The series ranks 10th among the best-selling video game franchises of all times, with a sales figure of over 200 million combining all the entries in the series. As of October 2019, all The Sims games combined generated lifetime sales of more than US$5 billion.
Edit: Still no evidence, huh? maxlin claimed a game dev career, and you're defending his argument. How much has your brand of indecently un-entertaining game design made? Name a title either of you can point to.
Edit: Yet again, still no evidence, and no rebuttal of my evidence, huh?
Let's look at your actual accusation:
akimbostrawman> If the "right side" is slandering innocent people into suicide for calling out blatant corruption, then i am fine with being wrong.
There was no corruption to call out. GamerGate started with an ex-boyfriend's blog post claiming Zoë Quinn traded sex for a favorable review from Kotaku's Nathan Grayson. Grayson never reviewed her game. Kotaku checked, and said so at the time. The "ethics in games journalism" scandal was a review that never existed:
What did happen was real: GamerGaters posted Quinn's home address and nude photos of her and drove her out of her home. They published Brianna Wu's address and sent her death and rape threats until she and her husband fled their home. Anita Sarkeesian had to cancel a talk at Utah State University after an email promised "the deadliest school shooting in American history." That's what the "right side" was doing in 2014.
The "innocent person slandered into suicide" you're alluding to is Alec Holowka, who died in 2019, five years after GamerGate, days after Quinn accused him of abuse. His own sister Eileen said he had been a victim of abuse, and also wrote "I will not pretend that he was not also responsible for causing harm." And she explicitly asked people like you:
"Alec specifically said he wished the best for Zoë and everyone else, so don't use our grief as an excuse to harass people."
So you're using a dead man's suicide as a weapon against the woman GamerGate already doxxed and drove from her home, against the explicit wishes of his own grieving family. You're spreading corruption and hate, not calling it out. That's GamerGate's playbook, seven years later, from someone still desperately clinging to it like a deranged little GamerGate boy.
You still haven't answered anything about Grayson, Quinn, Wu, Sarkeesian, or Holowka's sister. Your evasion is telling, and the ball's in your court.
akimbostrawman> I do not need the permission from anybody to mention my own real experiences
If you're talking about something you personally went through, then I misread you, and I'm sorry. I assumed you meant Alec Holowka, because that's the case GamerGate supporters always cite when they say "slandered into suicide." You don't need anyone's permission to talk about your own life, and I'm not asking you to stay silent about it. And if it's something you're still carrying, I mean this sincerely: please talk to someone. https://findahelpline.com lists crisis lines for every country.
But your personal experience, whatever it was, doesn't change a single documented fact about GamerGate. Nathan Grayson never reviewed Zoë Quinn's game. GamerGaters posted Quinn's address and nude photos and drove her from her home. They published Brianna Wu's address and sent her death and rape threats until she fled. Anita Sarkeesian had to cancel a talk over a mass shooting threat.
Those are the facts you still haven't addressed. Neither of us gets to replace them with our own experiences.
qweqwe14 4 hours ago [-]
Man are you OK? What are you even on about?
Woke is cringe, it's a settled matter, calm down buddy.
akimbostrawman 4 hours ago [-]
>So you're using a dead man's suicide as a weapon against the woman GamerGate already doxxed and drove from her home, against the explicit wishes of his own grieving family.
I was gonna ignore your further ignorant remarks however this is too disgusting to not reply to. I do not need the permission from anybody to mention my own experiences just because they got bullied into silence and accepting similarly unhinged behaviour to finally have there peace.
akimbostrawman 5 hours ago [-]
The only thing the continues historical revision about GG is proving, is that the collusion between game developer and game reviewer/media is way worse than GG ever demonstrated.
If the "right side" is slandering innocent people into suicide for calling out blatant corruption, then i am fine with being wrong.
Edit: rewriting your post with more and more nonsensical claims while decently entertaining is what i expect.
Edit2: I never claimed to have made games but i guess just daring to disagree with your world view warrants genetic fallacies, false allegations and insults, once again what i expected.
chatmasta 15 hours ago [-]
Looking forward to setting this up manually after my agent refuses to do it. Like the good ol’ days.
seaal 14 hours ago [-]
Just ask one of the Chinese models.
sippingabonedry 16 hours ago [-]
Wonderful.
Anyone else bother to notice iOS still trusts 2 of the forged certs on the test site? I'd like to politely know what the fuck is going on because this is far from being "fixed".
robrain 15 hours ago [-]
Mine were all blocked this morning when I informed my family of the mitigation methods.
I've just been rechecking everything and both iOS and MacOS browsers (Safari and Orion tested) now accept one (for MacOS, 27.0.1) or three (for iOS, 27.0.1) of them. I know the revocation is not an OS update, just including the version number for completeness.
EDIT: iPadOS with the same browsers continues to pass the tests.
Further EDIT: iPadOS now accepts one of them. This has to be a load issue on the "got a problem site", surely? Maybe a check for a certificate error message that never hits because a timeout beats it?
sippingabonedry 14 hours ago [-]
> Further EDIT: iPadOS now accepts one of them. This has to be a load issue on the "got a problem site", surely?
No, because it lets you successfully navigate to the forged CA test site.
You'll get a message to the effect of, "you shouldn't see this, this is bad"
Try clicking the link containing the CA's name for any that fail the test.
robrain 13 hours ago [-]
Cool.
Checking Keychain access shows none of the intermediates, but it does have the emSign ECC Root CA - G3. Manually setting that to "Never Trust" stops the Mac browsers seeing the intermediate test sites as it should.
I didn't go into this much detail this morning, so I don't know if previously the revocation from Apple hit the root as well as the intermediates. But right now, on my Mac, trusting that Root lets my browsers connect to the Intermediate CA ending C=NL. Switch the trust off and I go back to green "Did not connect".
I guess the ball is in Apple's court as far as the iOS family goes.
EDIT: intriguingly (to me at least), the AAA Certificate Service Root is still Trusted, yet the intermediates chained to it are all green "Did not connect"
EDIT: I'm not promoting this nuclear option as a "solution" by the way, merely presenting some diagnostic information to help the group mind.
kccqzy 14 hours ago [-]
Apple’s OCSP server may be overloaded?
I don’t know if possible on iOS but I remember multiple incidents where people recommended turning off CRL and OCSP on macOS to speed things up. That even used to be a setting in the GUI. https://imgur.com/XVHWCNz
sippingabonedry 14 hours ago [-]
The individual CA's host the OCSP and CRLs, not Apple.
It's possible the Indian CA is overloaded.
My question is why the system trust store has not been updated to distrust the shady root CA?
xuki 16 hours ago [-]
Which iOS version? 27.0.1 here and they're all revoked for me.
sippingabonedry 16 hours ago [-]
26.7.1 still (randomly) trusts 2 out of the 12 compromised chains. All browsers impacted.
Never thought there would be a silver lining on this issue. Fuck yeah.
deadbabe 15 hours ago [-]
Can someone explain the significance here, a lot has happened in 24 hours.
Gigachad 15 hours ago [-]
An Indian Certificate Authority eMudhra was found to have a private key that’s literally the number 4. So using that you can sign valid https certs for anything that isn’t checking the revoked list.
brendoelfrendo 15 hours ago [-]
They had 8 intermediate certs with private keys under 1 byte (<256). The most egregious was 4, but any of those 8 were pitiful.
bombcar 14 hours ago [-]
It would’ve almost been better if the eight keys were just 1 2 3 4 5 6 7 8
mceachen 13 hours ago [-]
That's the combination to my HSM!
lifeisloving 14 hours ago [-]
Why is it important to you to mention they're indian in this context?
Elsewhereindeed 13 hours ago [-]
Well it helped me understand the source of the strange flag.
ButlerianJihad 13 hours ago [-]
For starters, they are not American, and this site has a predominantly American and European audience and participation.
Also, while I'm not sure what a "mudhra" is, I do know that mudra is a Hindu term for a sign or symbol made by the hands, for example the way an idol is posed in a temple. It's a form of sacred sign language. Therefore, "mudra" or its related term is intrinsically linked to Hinduism in India.
Also, I am the kind of pessimist who goes through my device's root stores, and I "distrust" every root CA that I don't need to trust. This has never broken anything within my perception. I distrust the Turkey CAs, the Chinese communist CAs, the Indian CAs, and any other non-NATO sorts who have no reason to be serving any data to my devices.
* the compromised eMudhra certs were not root CAs but intermediates.
> On October 17, 2026, browser root programs received a report that the private keys of eight eMudhra intermediate certificates had been compromised. The private keys were 4, 56, 66, 115, 155, 156, 230, and 237. A P-384 elliptic-curve private key normally has about 384 bits of entropy, but these keys had between 3 and 8 bits.
Hobadee 13 hours ago [-]
I wonder if there is any significance to those numbers? Is it the birthday of whoever minted them or something?
naniwaduni 13 hours ago [-]
It looks like they were just generated (or stored) as 8-bit integers instead of the intended range.
(While the smallest one being 4 memeworthy, I don't see any particular indication that it's exceptional within the samples, rather than just the smallest when sorted. So they're probably all 8-bit keys, not 3-bit—it's the (unknowable) generator distribution, not the width of the actual key).
0xbadcafebee 15 hours ago [-]
Remember twenty years ago when tools like this were "controversial" because you could "just download it and hack anyone" ? Except the only systems you could hack were... insecure ones... so people updated their systems to resist the tools' attacks, and we all ended up more secure.
DrammBA 16 hours ago [-]
I love how someone's security disaster becomes someone else's feature.
xp84 16 hours ago [-]
I agree. We may as well make some lemonade out of these lemons. IMHO the ability of companies to 'securely' close off hardware and software from their users is a sad casualty of the success of cryptography, and not a feature.
r3trohack3r 16 hours ago [-]
Most things have tradeoffs
At some point you’re forced to stack rank two or more of your values in a case where they’re mutually exclusive
Bratmon 15 hours ago [-]
As the percentage of technology controlled by people actively using it to do evil increases, so does the net value to society of a trivially-expliotable zero-day.
1vuio0pswjnm7 13 hours ago [-]
To some it's not really "security". At least it's not securing them from their greatest "threat" (read: annoyance): so-called "tech" companies engaged in data collection, surveillance and advertising services
In fact, it's securing _the companies_ against potential competitors and users who might raise privacy concerns
The Fortune 500 "MiTM's" TLS traffic from their local networks
Every individual with a local network should be doing the same
I prefer haproxy to mitmproxy. It's faster
notpushkin 8 hours ago [-]
> I prefer haproxy to mitmproxy. It's faster
If you’re proxying all the traffic in your network it makes sense, naturally. mitmproxy is usually used for debugging and/or reverse engineering (e.g. with a specific app).
tonymet 16 hours ago [-]
I seriously laughed at the flag. public wifi is going to be lit.
MajorTakeaway 15 hours ago [-]
What about using a VPN on public wifi?
tonymet 20 minutes ago [-]
For the public WiFi threat vector (e.g. a rogue WiFi AP running MITMproxy to sniff your traffic) you would be protected by vpn.
But the broader threat, e.g. older & unpatched devices with these flimsy CAs installed & not upgradable or revocable – tough cookies.
thway15269037 14 hours ago [-]
At places where I did work anything private over even properly protected wifi was forbidden after several wifi vulns in 2018. So the only thing available on company's wifi was vpn gateway and page with manual how to set it up.
So, not trusting anything wireless is a thing for almost a decade.
latencyharbor 12 hours ago [-]
[flagged]
hiyer 12 hours ago [-]
Not affiliated with emudhra in any way, but calling the option "emudhra" is in bad taste. The employee(s) response for this error will likely never live it down anyway, and now they have this to remind them of it for years to come.
Probably would have been better to call it "compromised" or something like that.
cpburns2009 3 hours ago [-]
Isn't it named after the company, not the employees? Would you also object to a rootkit optioned labeled "sony"? The mistake made by Emudhra is completely unacceptable for a trusted CA.
Zenbit_UX 10 hours ago [-]
You seem overly worried about the feelings of a company.
rs_rs_rs_rs_rs 11 hours ago [-]
I disagree, I think shaming people for egregious work needs to be used more.
https://tech-insider.org/emudhra-ca-private-keys-compromised...
(Credit to the relevant xkcd. :D )
Here's how the famous "Debian Weak Keys" come into existence:
OpenSSL had two buffers we care about here for generating random keys, with associated code to mix from those buffers into the data that's going to finally be used to produce cryptographically random numbers, lets call these bufferA, bufferB and mixA, mixB
In some cases bufferA is intialized by reading data from somewhere, in other cases it was never initialized. So mixA is doing uninitialized reads in those other cases. OpenSSL is written in C and in principle reading uninitialized data is Undefined Behaviour in C, but in practice nothing terrible happened here, you'd probably get zeroes, in some cases maybe unrelated trash. However, tools for spotting UB in your C library kept flagging mixA, which read this uninitialized data, as a problem.
bufferB is always crucial, if this isn't used the numbers won't be very random at all. This data is always initialized. But mixB is very similar code to mixA, after all it is doing similar work.
OpenSSL had rejected work to "fix" the mixA uninitialized bug but a Debian developer decided that it was too annoying so they patched mixA out. If that had been the whole story nothing terrible happens and nobody would remember today. However since mixB is similar, that Debian developer asked the OpenSSL developer list hey, is it OK to patch out mixB too?
And the developers said it was OK. The result is that Debian shipped OpenSSL which did not actually generate truly random keys. There were some number (thousands?) likely and of those a handful were especially most likely to be picked, based on exactly how soon after system start you wanted to make some keys with OpenSSL.
Now, after this blew up those developers said they thought the question was about testing. And IIRC it was possible to look at the same email and, if you know mixB is crucial, you think obviously they just want to test that their change does what they expected, nobody would patch out mixB in production, that's crazy. But the developer who wrote the email intended a different meaning, they really did mean to patch out mixB and were asking if that's OK.
That's as clear an explanation about the situation as I have ever read. I don't know the occasion to need to explain it to anyone else will arise, but when it does... or I may use it as example of the consequences of shallow communication when serious outcomes may arise. (Ill be sure to credit the source 'tialaramex' on HN)
Train driver and signaller both believe they've reached the same understanding of the situation, but their understanding actually remains divergent, and the driver (plus a MOM) nearly gets killed as a result.
The xkcd was 2007 [0], the Debian issue was 2008 [1].
It was used in pretty much every blogpost describing the Debian issue, but it wasn't created because of the Debian issue (unless they gave Randall an 8-month head-start before disclosing it).
(I don't mean this as a "well akshully" - but for me it's more impressive that it's a truism that keeps coming true, than if it was just a swipe at them in the first place)
[0] https://web.archive.org/web/20070930232116/https://xkcd.com/...
[1] https://lists.debian.org/debian-security-announce/2008/msg00...
https://security-tracker.debian.org/tracker/CVE-2008-0166
https://lists.debian.org/debian-security-announce/2008/msg00...
Release is out now, including a blog post at https://www.mitmproxy.org/posts/releases/mitmproxy-12.3/. There isn't really much to explain, you just pass `--emudhra`. :)
[0] https://news.ycombinator.com/item?id=50190859
So from the perspective of hacking old IoT devices, if your device hasn't been updated since 2018, the AAA path should work; if since February 2025, either path works; if since October 2026, the emSign path.
I object to the word compromised. Perhaps "available" or "enumerated" or maybe for the etymologists "unipromised".
I would be amazed to see a TV that is checking CRLs and keeps the CRLs up to date.
Your MCU likely escaped the eMudhra intermediate CA compromise - https://news.ycombinator.com/item?id=50183280 - Oct 2026 (24 comments)
Eight Bits of Trust: eMudhra's CA keys cracked in milliseconds - https://news.ycombinator.com/item?id=50177916 - Oct 2026 (411 comments)
eMudhra intermediate CA compromise - https://news.ycombinator.com/item?id=50166579 - Oct 2026 (478 comments)
server: here are latest ads
btw, the ads are capable of code execution for whatever reason so now you have an RCE on your hands for your client
I was mainly interested in testing which IoT devices are affected and protecting them, not trying to sniff their traffic since it's been a long day. My proxy thus just intercepted and forwarded the traffic upstream using a fresh TLS connection that does not use the compromised keys.
https://en.wikipedia.org/wiki/Illegal_number
Being bad at choosing random numbers is not a crime, I am afraid.
I can imagine them being sued for "securities fraud" (as Matt Levine suggests) but only if they were a US publicly traded company.
which brings me to my next question, what if you rerun the same process for all the certificates in the "approved" stores, give them 1 min per certificate.. just to see how many other CAs are being "friendly" to parties that could take benefit of that...
update... I'm talking out of ignorance here... but assuming cli open source tools, should they prevent you creating certificates with weak settings unless --emudhra-level-security is passed?
also, what amount of time is needed in say a "civilian" gpu with claude to vibe code something that can test a certificate so say 80 bits.. or whatever is the level where yes, you cannot find the values to generate the certificate with a cpu... but you can with a gpu in say 1 day? say it's 80 bits... how many CA stores are there? how much does it cost to rent gpus to run in parallel to test 1 day of civilian gpu to check each certificate if you use one of these very expensive ones?
Versus: "The government ordered us to give them the keys and forced us to remain silent about it" - now all the damage lies on the government, who is likely known to already do stuff like that (or at least it isn't a surprise) and will hide behind the banner of safety or national security or something. (Whether it's true or not)
Per AI, 10²¹ years
Alternatively I would presume you could do it in 1 year with 10²¹ GPUs.
I think they deserve more than 8 bits of infamy.
Yet you and maxlin are still clinging to and defending its bigoted long disproven ideas, as if it's core to your personality.
So you're the deranged out of touch ones, decades behind the times, and on the wrong side of history, unable to counter my arguments or EA's $5 billion in sales with any evidence at all. You're just bigoted GamerGate armchair vibe game designers, with lots of hot air but nothing to show.
Edit: Your "slandering innocent people into suicide" is pure psychological projection from a bigot defending doxing and harassing women.
Thanks for proving my point by pulling evidence-free hallucinations and vibes out of your ass that can't counter $5 billion of evidence you're wrong.
Actually it was $5 billion 7 years ago, and a lot more now. So name a more successful homophobic anti-woke title.
https://en.wikipedia.org/wiki/The_Sims#Legacy
>Legacy: The success of The Sims has resulted in Guinness World Records awarding the series numerous world records, including, as of 2017, "Most Expansion Packs for a Videogame Series" and "Best Selling PC Game Series", with sales estimates ranging from 36 to 50 million units. The series ranks 10th among the best-selling video game franchises of all times, with a sales figure of over 200 million combining all the entries in the series. As of October 2019, all The Sims games combined generated lifetime sales of more than US$5 billion.
Edit: Still no evidence, huh? maxlin claimed a game dev career, and you're defending his argument. How much has your brand of indecently un-entertaining game design made? Name a title either of you can point to.
Edit: Yet again, still no evidence, and no rebuttal of my evidence, huh?
Let's look at your actual accusation:
akimbostrawman> If the "right side" is slandering innocent people into suicide for calling out blatant corruption, then i am fine with being wrong.
There was no corruption to call out. GamerGate started with an ex-boyfriend's blog post claiming Zoë Quinn traded sex for a favorable review from Kotaku's Nathan Grayson. Grayson never reviewed her game. Kotaku checked, and said so at the time. The "ethics in games journalism" scandal was a review that never existed:
https://en.wikipedia.org/wiki/Gamergate
What did happen was real: GamerGaters posted Quinn's home address and nude photos of her and drove her out of her home. They published Brianna Wu's address and sent her death and rape threats until she and her husband fled their home. Anita Sarkeesian had to cancel a talk at Utah State University after an email promised "the deadliest school shooting in American history." That's what the "right side" was doing in 2014.
The "innocent person slandered into suicide" you're alluding to is Alec Holowka, who died in 2019, five years after GamerGate, days after Quinn accused him of abuse. His own sister Eileen said he had been a victim of abuse, and also wrote "I will not pretend that he was not also responsible for causing harm." And she explicitly asked people like you:
"Alec specifically said he wished the best for Zoë and everyone else, so don't use our grief as an excuse to harass people."
https://www.pcgamesn.com/alec-holowka-death
So you're using a dead man's suicide as a weapon against the woman GamerGate already doxxed and drove from her home, against the explicit wishes of his own grieving family. You're spreading corruption and hate, not calling it out. That's GamerGate's playbook, seven years later, from someone still desperately clinging to it like a deranged little GamerGate boy.
You still haven't answered anything about Grayson, Quinn, Wu, Sarkeesian, or Holowka's sister. Your evasion is telling, and the ball's in your court.
akimbostrawman> I do not need the permission from anybody to mention my own real experiences
If you're talking about something you personally went through, then I misread you, and I'm sorry. I assumed you meant Alec Holowka, because that's the case GamerGate supporters always cite when they say "slandered into suicide." You don't need anyone's permission to talk about your own life, and I'm not asking you to stay silent about it. And if it's something you're still carrying, I mean this sincerely: please talk to someone. https://findahelpline.com lists crisis lines for every country.
But your personal experience, whatever it was, doesn't change a single documented fact about GamerGate. Nathan Grayson never reviewed Zoë Quinn's game. GamerGaters posted Quinn's address and nude photos and drove her from her home. They published Brianna Wu's address and sent her death and rape threats until she fled. Anita Sarkeesian had to cancel a talk over a mass shooting threat.
Those are the facts you still haven't addressed. Neither of us gets to replace them with our own experiences.
Woke is cringe, it's a settled matter, calm down buddy.
I was gonna ignore your further ignorant remarks however this is too disgusting to not reply to. I do not need the permission from anybody to mention my own experiences just because they got bullied into silence and accepting similarly unhinged behaviour to finally have there peace.
If the "right side" is slandering innocent people into suicide for calling out blatant corruption, then i am fine with being wrong.
Edit: rewriting your post with more and more nonsensical claims while decently entertaining is what i expect.
Edit2: I never claimed to have made games but i guess just daring to disagree with your world view warrants genetic fallacies, false allegations and insults, once again what i expected.
Anyone else bother to notice iOS still trusts 2 of the forged certs on the test site? I'd like to politely know what the fuck is going on because this is far from being "fixed".
I've just been rechecking everything and both iOS and MacOS browsers (Safari and Orion tested) now accept one (for MacOS, 27.0.1) or three (for iOS, 27.0.1) of them. I know the revocation is not an OS update, just including the version number for completeness.
EDIT: iPadOS with the same browsers continues to pass the tests.
Further EDIT: iPadOS now accepts one of them. This has to be a load issue on the "got a problem site", surely? Maybe a check for a certificate error message that never hits because a timeout beats it?
No, because it lets you successfully navigate to the forged CA test site.
You'll get a message to the effect of, "you shouldn't see this, this is bad"
Try clicking the link containing the CA's name for any that fail the test.
Checking Keychain access shows none of the intermediates, but it does have the emSign ECC Root CA - G3. Manually setting that to "Never Trust" stops the Mac browsers seeing the intermediate test sites as it should.
I didn't go into this much detail this morning, so I don't know if previously the revocation from Apple hit the root as well as the intermediates. But right now, on my Mac, trusting that Root lets my browsers connect to the Intermediate CA ending C=NL. Switch the trust off and I go back to green "Did not connect".
I guess the ball is in Apple's court as far as the iOS family goes.
EDIT: intriguingly (to me at least), the AAA Certificate Service Root is still Trusted, yet the intermediates chained to it are all green "Did not connect"
EDIT: I'm not promoting this nuclear option as a "solution" by the way, merely presenting some diagnostic information to help the group mind.
I don’t know if possible on iOS but I remember multiple incidents where people recommended turning off CRL and OCSP on macOS to speed things up. That even used to be a setting in the GUI. https://imgur.com/XVHWCNz
It's possible the Indian CA is overloaded.
My question is why the system trust store has not been updated to distrust the shady root CA?
Edit: I'm not the only one with this issue:
https://www.reddit.com/r/iphone/comments/1xbvxgd/emudhra_cer...
My best guess is it's soft-failing on a failed OCSP lookup?
Also, while I'm not sure what a "mudhra" is, I do know that mudra is a Hindu term for a sign or symbol made by the hands, for example the way an idol is posed in a temple. It's a form of sacred sign language. Therefore, "mudra" or its related term is intrinsically linked to Hinduism in India.
Also, I am the kind of pessimist who goes through my device's root stores, and I "distrust" every root CA that I don't need to trust. This has never broken anything within my perception. I distrust the Turkey CAs, the Chinese communist CAs, the Indian CAs, and any other non-NATO sorts who have no reason to be serving any data to my devices.
* the compromised eMudhra certs were not root CAs but intermediates.
> On October 17, 2026, browser root programs received a report that the private keys of eight eMudhra intermediate certificates had been compromised. The private keys were 4, 56, 66, 115, 155, 156, 230, and 237. A P-384 elliptic-curve private key normally has about 384 bits of entropy, but these keys had between 3 and 8 bits.
(While the smallest one being 4 memeworthy, I don't see any particular indication that it's exceptional within the samples, rather than just the smallest when sorted. So they're probably all 8-bit keys, not 3-bit—it's the (unknowable) generator distribution, not the width of the actual key).
At some point you’re forced to stack rank two or more of your values in a case where they’re mutually exclusive
In fact, it's securing _the companies_ against potential competitors and users who might raise privacy concerns
The Fortune 500 "MiTM's" TLS traffic from their local networks
Every individual with a local network should be doing the same
I prefer haproxy to mitmproxy. It's faster
If you’re proxying all the traffic in your network it makes sense, naturally. mitmproxy is usually used for debugging and/or reverse engineering (e.g. with a specific app).
But the broader threat, e.g. older & unpatched devices with these flimsy CAs installed & not upgradable or revocable – tough cookies.
So, not trusting anything wireless is a thing for almost a decade.
Probably would have been better to call it "compromised" or something like that.