>DO NOT REDEEM THE PRIVATE KEYS
How the fuck something like this even happens??
>>110123315
>SAAAAAAAAAAAAAR
>>110123598oh
>>110123281>emudhra What in the fucking jeet is this
>>110123598Lmao
>>110123598100% of indian woman are ugly as fuck
>>110123644Explain Sunny Leone
>>11012366199,99^999999999999999999999999999999999e%
NOBUS
Now go look up what their 381bit private key value actually was in all the compromised keys.
>>110123877post it then
>>110123315Make CA's the single point of failure.>the_keys_to_internet.webm
>>110123281MUDHRACHOD
>>110123281what's the qrd of the fallout?
>>110124017a lot of people hate niggers and are not afraid to say it in the secretslol
>>110123598SAAAAAAAAAAAAAR!!!
>>110123598
>https://bugzilla.mozilla.org/show_bug.cgi?id=2083449>On 17th October @ 20:06 UTC, Mozilla received a report to certificates@mozilla.org>Mozilla acknowledged the report @ 20:08 UTCThat's actually fast as shit.
>>110124194Yeah I think Firefox updated earlier than my chromium based browsers.
>>110124194everything went comically red at their hq
>>110123281Does this require updates to ca-certificates on Linux too? Presumably everything needs to revoke their trust of these keys now.
>>110124255Yep:https://bugs.gentoo.org/984601At least they're on it.
>eMudhraTruly shocking.
>>110124194>After Wayne's report of key recovery, I was able to recover the private keys for the impacted keys trivially. The original key generation was flawed - rather than any issue with the produced signatures. >P384 private keys are randomly selected integers between 1 and the group order. The 8 impacted keys all used integers less than 256. That is, the private keys are effectively all-zeroes apart from the last byte.Holy fucking shit, imagine making the private keys less secure than abc123.
>>110123644Attractive women have better things to do than work in IT companies.
...Does this mean skiddies can see my search history?
>>110124387Lmao
kek
>>110124629its true, see >>110122614
>>1101238984
>>110124427Yeah those yacht parties would be a total sausage fest without them
>>110124629>>110124664
>2 bits of entropyKEK
ban streetshitters from the internet
Okay but imagine you were making a new key pair for whatever and you just happen to accidentally roll the magic all 0-bit private key. I bet you'd feel a little cheated, too.
>>110123315the d value they fed into the elliptic curve algorithm used to generate the keys were 156 155 115 66 230 *4* 56 and 237 these are supposed to be random 384 bit values
>>110124139lmao
>>110124728the expected attempts to get a 0 is 39402006196394479212279040100143613805079739270465446667948293404245721771497210611414266254884915640806627990306816 it's not happening
>>110124139
>>110123856it's far from a nobus state actors can force their local CAs to forge certs for them
>>110124861You only need to be lucky once
out of any possible number they picked 4 I wonder why they decided that number specifically.
>>110123281>>110123315>>110123598It sucks that jeets aren't just retarded in their own poop hellhole. Instead their stupidity affects us too.
so they did literally picrel?
>>110124982Very easy to remember saar :)
>>110124758>>110125110good morning saar
>mutthra
>>110123644Center, green dress, glasses is good with me
>>110124629Randall won. xkcd won.
>>110123598>>110123598
Fuck, I'm going to have to update my browser for this aren't I.
>4yoink
>>110125944All browsers auto-pushed new certs like an hour of this happening.
>>110125536Both jeets and muslims are subhuman vermin.
>>110123598I can feel the smell of shit going through this image, damn. Also>Mostly women teamWhat the fuck, this shit even reached there, huh
>>110123644With a margin error of 5%
p4jeet
>>110125999Can we add turks and french to the list
>>110123598woah.. our engineers are so bright and beutiful..
>>110123598Some of them are even barefootWhat the fuck
>>110125944Your browser is fine. The problem is all of those devices which cannot be updated, like old iOS devices or obsolete computers.
>>110123315saar we are doing the program ok very good
>>110123853>99,99^999999999999999999999999999999999e%If you are going to use quantities at least ask a chatbot to give you a hand>How many nines after the decimal point are in the percentual difference between 1.00 and 1 over india population
SIR ALL THE KEYS HAVE BEEN REDEEMED
>>110123281Please tell me they will never, ever be allowed to be a CA again.They have fundamentally fucked up beyond all repair and can not be trusted with this power.
Genuinely how the fuck did they even screw up this bad? Isn't it standard protocol for major companies to have some sort of entropy-checking mechanism to autoreject such bogus security keys?
>>110126438>racism outside of /b/
>>110123598Imagine the smell
>>1101255363000 years of caste system did this
>>110126438BLAAAAADY FAK U BLODY BASTERD
>>110126483Did you click on the wrong post or something? I'm pretty sure there are bigger racisms going on ITT than my genuine question that you just quoted.
>>110126429Nothing will happen.Nothing ever happens when these companies fuck up.Unless it happens to a rich person personally which it somehow never does.I'm pretty sure they have a whole infrastructure to themselves.
>>110126527Since when does anything happen to rich people?We know a whole ring of them who gangraped kids nonstop on Epstein Island and nothing whatsoever happened to them.
>>110126438Saar, 8 bits is de 256, 2ˆ8, so we have the 256 bits security. India is best, Superpower by 2256
>>110123644*proves you wrong*what now nerd?
>>110126490In India you probably can't even tell, the whole country probably smells like wet ass
>>110124982They were supposed to use random 384 bit values.All the numbers are between 0 and 384.I think you can see what Elon Musk's BRILLIANT INDIAN H1B TALENT thought 384 bit meant.
>>110126438not even being racist, but unironically izzat + jugaadit's the chutzpah to take the most laziest shortcuts, combined with the unwillingness to admit mistakes. an extremely deadly combo when it comes to doing ANY sort of workindia seriously needs a cultural revolution of sorts to get its shit together. and the west also seriously needs to stop importing so many of them until they fix this issue.
-----BEGIN RSA PRIVATE KEY-----4-----END RSA PRIVATE KEY-----
>>110126629The not admitting to mistake is probably why they didn't speak up once they clearly would have spotted the issue after the CRL signing faux pas.
>>110126438My guess, the only actual one on this shit ass website, is that they had a test cert where someone generated with those low values, and then some retard uploaded the wrong cert. They had plenty of correct certs and a fucking certificate authority trusted by the major browsers obviously knows how a cert works, the Le funny explanation of not knowing what 384 bit means just doesn't hold up
>>110123281I always remember installing netbsd years ago and they had a distrust of ca-certificates and you had to manually create/build and install them yourself. Now i can see why.
>>110126700>is that they had a test certWhy? In what conceivable wirld does a CA need a test certificate? Or 8.
>>110123598>trust delivered
I don't know why any browser manufacturer or device maker would trust eMudhra at this point just revoke all their certs
>>110126754because it would be racist sir!
explain to me how some random indian company has the power to shut down all services that use PhP
>>110126735In what conceivable world do they need to let the new retard intern have free reign over making the new certs and uploading them?
>>110126792the indian company being retarded has nothing to do with the php vulnerability they just happened at the same time
>>110126792Two seperate issues.
>>110126795>let the new retard intern have free reign over making the new certs and uploading them?The intern doesn't validate certificates anon....
>>110123315I don't know SAAR you tell me.
>>110126809>>110126822ohso they were just part of a trusted circle that distributes certificates. am I getting this right?
>>110125960>>110126271I have a fairly old browser because shits keep pushing garbage UI changes with security so I got tired of having to fix things back the way I want them with every update. It's still 'modern' but even something from 3 years ago is out of date despite still working on every site. I tried emudhra.we-have-a-problem.com and the 8 tests showed 'insecure' still.
>>110123598they're smiling but this event will be used as justification for delivering a custom MRNA protein that kills their specific genetic compositionthey will go extinct because of the wrong git push, actually wild
>>110126868Company, but yeah.
>>110126868Imagine if Microsoft suddenly lost power and any given retard can pretend to be Microsoft and send you a system update. This is why this is a catastrophic scenario.
>>110126868eMudhra is a Certificate Authority, they verify that a website is who they say they are. For some reason their private keys that they use to verify their own identity were very easily reversed and someone leaked them publicly so now anyone can impersonate them and issue certificates to websites on their behalf.Some internet connected devices have these certificates baked into their firmware and are very hard to remove or update in the future so these certs will probably cause lasting damage well into the future.
>>110125110>>110124758
>>110126936>>110126943I'm sure the security risk is massive, I just don't know how a private company in fucking india could get to so much responsibility.
>>110126792remind me, what caused the aws outage last year? something about dns?
>>110123598they are barefoot INSIDE a public, IT company building during a COMPANY PHOTOSHOOOT. you quite literally cannot make this shit up
ELITE HUMAN CAPITAL
>>110126967Between this and the PHP vulnerability I would consider this to be much more severe. The PHP vulnerability can at least be fixed but leaking the private keys to a root CA is catastrophic. Updating everything to fix the leak could take months/years
>>110123315>>110126438Because Indian nepotism is insane.It's much more blatant than Jewish nepotism, and thats saying ALOT.And at least Jewish nepos are still semi-competent most of the time. Indian nepotism will put some of the most retarded mouthbreathers in some of the most highly esteemed positions of power.And with the advent of AI/vibecoding, it's only gotten worse because the mouthbreathers can now feign competence much better (until SHTF to the point of no return).
>>110125110>>110124758>>110124629
reminder to everyone that still uses their old ass apple/android phone way past the OEM support - search certificate in options, find the 4 certs that are by that company and disable them - you can quite easily be hoodwinked by a malicious ad
>>110123598>jeets>deliver trust>receive eMudYou can't make this shit up. It's over for the muds
>>110126017>>Mostly women team>What the fuck, this shit even reached there, huhActually, the less gender equal a society is, the more women there tend to be in STEM fields. This is known as the "gender equality paradox"
>>110127416I'm sure there meaning of equality is stupid making this graph bunk
>>110127476>least gender equal: Morocco, Saudi Arabia, Oman>most gender equal: Norway, Finland, SwedenIt seems to check out.
>>110126997Doesn't the device still need to visit a site spoofing the certificate? So the attacks will be through discontinued services/websites that old devices still call home to, whose domains have been bought out by someone with the explicit purpose of exploiting further vulnerabilities on those devices.I can only assume there must be other ways to use this.
>emudrasir
>>110123644I had a TA that was a solid 6/10.
>>110126661based, admittedly
>>110126034quite generous
>>110127072https://emudhra.we-have-a-problem.comScroll down & see if you passed the checks.My old iPhone got 6 insecure results.Although I imagine there'll be a rollout soon to just fix everything? Don't see why they can't just do that.
>>110126566anon that looks like a transvestite
>>110125536>muslim aryan? Wut.
>>110126175Aren't turks muslim?And the french obviously deserve the deepest pit of hell for existing.
>>110127611I think you can poison a local dns server maybe to redirect some traffic to you
>>110126601this was the best part to me
>>110123598I try not to be racist, but Indians make it so easy to be racist towards them. They proudly embody every racist stereotype said about them. It's like they don't have the basic self-awareness to realize that.
>>110126566Hideous
>>110123644Haha no
Mr. Babu will save us
>>110127416>>110127476>>110127533It makes sense when you think about it. If you're in a wealthy western nation like Finland or Norway, you have societal safety nets to fall back on and lean into. You aren't going to starve or get forced into some shitty arranged marriage just because you aren't becoming a 1%er. The vast, vast, /vast/ majority of people are happy doing a job that they enjoy and gives them some kind of fulfillment even if it means they're comfortably in the middle class.Third world... err.. excuse me "developing nations" don't offer that luxury. If you're a woman in India that isn't on a career path that offers significant financial freedom and independence, you have a good chance of being locked into being a broodmare for some piece of shit that may beat you. There is enormous social pressure to push yourself hard into any career that will give you opportunities, even if you ultimately have no real passion for it, because your alternative is a combination of poverty, misery, and general subservience as opposed to a quiet life of comfortable mediocrity.If you can have the family you want, whether it's a couple of kids, cats, or dogs, can drink your fancy flavored coffees when it starts to get cold, go to sleep in a comfy bed in a warm room with a belly not wracked by hunger, enjoy a few vacations to other parts of the world from time to time, and so on and so forth, what does slaving away for a career you hate really have to offer for you? OK, you can drive a nicer car, buy a watch or some jewelry that you don't really need. Those things are nice, but most people don't think they're worth being miserable for. Many women do think that they'd rather be unhappy at work than trapped in a marriage someone they despise, stuck caring for their piece of shit husbands parents who do nothing but bitch about how you do nothing right. So they sacrifice enjoyment in their careers to enjoy their home life. It's really not that complicated.
>try searching for emudhra on youtube to see securityfags losing their minds>indian videos and AI slop
>>110126967>I just don't know how a private company in fucking india could get to so much responsibility.I'd bet they had a handful of guys who were okay at shit back in 2008 when they started and got a contract for being cheap and passable then, but didn't keep up on educations for the guys who knew shit and hired dumbasses who didn't know anything to run thru a cheap quick training.
>>110126964
>>110128243Anyways, on topic.I'm kind of surprised how many services don't lockdown keys. It seems like there's a few big lists maintained by browsers and a few other major authorities that everyone just uses by default, and nobody seems to consider the attack vectors of having 3 trillion random companies providing keys for stuff. This props up all the time in embedded devices. I've seen so many shitty implementations where they basically just copy paste a big list of keys into the ROM and ship it, and then when some kind of fuckup like this happens you have infinity devices in random manufacturing facilities that will never ever ever be updated or replaced unless they outright fail, and companies providing support for them that don't even understand the generalities of how there could be a problem.On the other hand, those shitty implementations have allowed me to reverse engineer proprietary garbage from long defunct companies to keep equipment running. Guess that makes me part of the problem, but hey, it's good money. If you can keep a machine that costs 20 million dollars to replace online and you only charge 250k, most companies are ecstatic.
>>110128256you should look up arma3 on dockerhub...I was expecting video game server images...all I got was vasharmalamapooja39 shit
>>110126566>looks like a man>covered in tatsWow, consider suicide
>>110125536>kuffar i'm aryan!No.
>>110125944what does this mean
>>110125110india isn't real, it's just a joke
>>110123598>womeme majorityof course it's going to be shitty with actual shit when u add indian women to the mix
uh oh, i'm posting the leaked keys;45666115155156230237don't do anything naughty with these super secret numbers anon!
>>110125002the west really should have practiced the principle of mutual non-interference 3 centuries ago instead of helping uplift backwards civilizations
>>110128857i agree, then we wouldn't have to deal with america
>>110128857but then how would your capitalists get cheap resources and cheap labor?
>>110124255I went so far as to completely dump the upstream root CAs, zero issues so far.If you're in a Western country and don't need to interact with the third-world, getting rid of non-US CAs is probably a good idea
>>110126898our world is not this just or fair, anonthey will continue to deliver substandard IT services at scale, indefinitely, as they simply forget this event entirely
>>1101269971) it's not a root CA2) it's almost worse than leaking a root CA privkey because they can say "it's just an intermediate CA" and maintain their izzat to some degree3) it's definitely worse than the PHP thing because PHP is a programming language and doesn't imply trust in any sense of the word, it's a programming language and all of them have vulnerabilities. it's expected that your Root/Intermediate CAs are the best of the best in terms of cryptosystems practitioners, clearly not the case hereif you aren't actively trying to avoid any kind of Indian input into your technology stack in 2026 you're going to have a bad time and posisbly have your entire company or personal information compromisedi'm starting to monitor some of the larger software projects for indian involvement using AI agents now, stuff that is load-bearing for me like curl and the gnu utils are going to get worse unless we cut these dumbfucks out of the contribution infrastructure
>>110123598>trust deliveredat least we're not speaking german
>>110128243you fail to point out how the dysfunction of brown people who are no longer under colonial control is somehow white people's problem
>>110123281This is the "Digital Covid" Gates has been threatening us with for like two years. The internet you knew is dead. Make preparations.
