A new illegal number just dropped: 4>The compromised eMudhra keys were defective at a level that’s challenging the imagination of many of the engineers studying the incident. A normal size for a NIST P-384 elliptic curve cryptography private key contains roughly 384 bits of entropy, a size allowing almost 2384, or a number with 116 digits, different possibilities. The private key sizes of the compromised keys ranged from 3 to 8 bits. Astonishingly, the private keys were 4, 56, 66, 115, 155, 156, 230, 237.>4, 56, 66, 115, 155, 156, 230, 237.https://arstechnica.com/security/2026/10/the-internet-goes-on-high-alert-after-discovery-of-8-compromised-tls-certs/
>>544705981>India-based certificate authority eMudhra Limite
Thank you India
>>544705981Holy hell indians are actually behind this fuck up.By Allah it feels good to be an indian hater
>>544706033Choo-choo-CHECKED!
>>544705981Can someone explain this in no tech jargon?
>>544706158Set your password to password or your luggage lock to 1234
Explain like i'm an immigrant from India with a PHD in cryptography that was top of my class of 1000 people and just arrived in Canada and displaced a native Canadian and took their government job because I don't understand what this means
>>544706206Yes, but what has it compromised?
>>544706237password is supposed to be 100 digit longit is 1 digit longthe number 4
>>544705981elite human capital saar
>>544706158Sure. It's a nothingburger now, but it wasn't for the year+ where the certificates were in place.The internet uses certificates to determine who is trustworthy and who is who they say they are. Certificates are chained together, like using a chain of trust. "Abe trusts Bob, Bob trusts Carl, Carl trusts Dave, therefore since I trust Abe I can trust Dave." In practice, this chain starts from very high up and propagates downward - Abe runs the most central part of the internet machinery, and Dave runs just a website, but since the chain of trust is there if you trust Abe you can still trust Dave.In this case, the problem is that Bob's password was absolute shit and anybody could impersonate him and forge the chain of trust. This meant that if someone had used Bob's certificate to create a trusted certificate, they could do particularly nasty shit like act as a man in the middle impersonating otherwise trusted websites and intercepting legitimate network traffic.
India has proven it can't be trusted with the internet. Pull the plug.
>>544706237jeets fucked up the internet because of their sheer retarded incompetence.
>>544706237It takes an eternity to guess a string of 2048 bits. It takes zero seconds to guess a 4 bit string.They were using keys that the phone in your pocket could crack 250000 times per second.
>>5447059814 IQ moment
>>544705981cyber plandemic
>>544706158The CA certs basically prevent websites hijacking vistors by encrypting Https, so your information is compromised when someone views the website traffic and has illegal access to the certs.
>>544706237jeet confused 384 bits with the number 384so instead of a number from 1 to 2^384, the password was a number from 1 to 384cracking the password would take 384 tries instead of 2^384, which is a pretty big number
>>544705981lollmao
Why are Indians allowed access to the internet and anything to do with security?
>>544706333> It's a nothingburger nowI saw some crazy fearmongering on twitter saying how this is like the burning of alexander and how you have to scramble to change every kind of password you use or some shit and you have to check the chain of trust to see which websites are comped or not. And I saw another post that shit is going to get real in the next 12 hours or so
>>544706158>>544706237Password is supposed to have 384 bits of entropy. Jeets heard this and thought it meant "a number between 1 and 384".Unironically. All the compromised keys were in that range.When you hear people talking about how Indians are just out-competing you, this is what they mean.
>>544706336good morning
>>544706525Fair. What I meant was, there's not any new damage that's going to be caused. The certificates have been revoked, and anybody who was using them is no longer able to use them.That doesn't mean that no damage was done while the certificates were in place, and we certainly could see some real shit when digging up what all happened in the meantime.
>>544706248the pajeets who made it that way then sent it to the public
>>544705981>The private key sizes of the compromised keys ranged from 3 to 8 bits.They only chose numbers they could count on three hands.>Ganges tier IT security. What a fucking joke india is.
>>544706599The sad part is that the jeet company that did this will have no repercussions and will continue issuing certs as if nothing happened
>>544706248This was a supposedly well-regarded certificate authority. Now anyone can create spoofing websites by creating fake certificates that makes the website appear safe.
>>544705981>India-based certificate authority eMudhra>india>eMudyou can't make this shit up. This is it for the jeet, it's over, flushed
>>544706690They don't issue the CA certs and the 9 certificates they had have been revoked.
>>544706705So do we just not go to any websites we previously have been to until this gets sorted or is it all just fucked forever?
Fucking india and the people there lolUnrelated: saw power supplies with "indian rating" and as it turns out this relates to having close to double nominal grid voltage for many hours or even days, regularly and constant spikesffsthey need to stay the fuck in india
>>544706748>janitors cleaned up after they shit on the floors so that makes things okay nowThanks rajesh.
>>544706593>Disables CORS completely because "it was getting in the way"I’m very guilty of this mainly because I have no idea how it works.
>>544706564>"a number between 1 and 384".They probably would have thought 1 was off limits. They probably heard "2^384" and interpreted it as "2 to 384".
>>544706777Not really. It’s not imposting the domains, so if you just stick to the urls you’re used to, it’s fine. Just don’t visit any obscure website for now. Or respond to any SMS saying "saar u hav an outstanding balance u must pay with target gift card, pls do the needful and click this link"
>>544706705Thank you.
>>544706158They were using a die to choose numbers for encryption. And then generating certificates on an 8 bit operating system.>Absolutely retarded nepoboomers outsourced global IT to some jeets with an 8 bit Atari DOS CPU and a single die they probably made out of a rape victim's knuckle bone.
>>544706237100% of Indians agree that incest has no negative effect on intelligence.
>>544705981>VE ARE TRUSTED SAARTIFICATE AUTHORITY SAAR, DO NOT REDEEM SAARTIFICATE
saarstechnica
why does this matter to white people who dont visit indian websites
>>544707950it means that old websites that were preserved in time are going to get burned down and vaporized and tuned into scam hubs in its place
>>544708075but if its just indian sites who cares? were white people using indian certificates on their websites too? i dont get it
>>544708129Some people are saying up to 75% of the internet is effected and any website that hasn't had any kind of security update in the past are going to be affected not just the indian ones.
>>544705981It's funny how destructive of an influence Indians are on a global scale, everything they're involved in turns into a giant fucking disaster because their entire culture centers around lying, stealing, and cheating (izzat)
>i z z a t5 letters is all you need
>>544707950>>544708129The problem is that the certificates were internet wide. Someone with one of these forged certs could legitimately have executed a man in the middle attack on Google, Amazon, pretty much any bank in the world, so on and so forth.If it was just jeets scamming jeets that would be one thing, I agree. But unfortunately these were the keys to the internet worldwide.That's also not to say that this actually happened. We don't know yet if these certs were abused in the wild. But even if it didn't happen, it could have.
>>544708211oh damn. so it lets people easily hack and edit the site? is this actual incompetence or was this a booby trap kike intel agencies set years ago so they could clamp down and control the internet now that the masses are getting unruly with the aristrocracy? seems like everything in the past year has been geared toward censoring the internet
>>544707950They're a ROOT certificate authority, they can sign certificates for ANY website. Yes, they gave Indians the power to do this without any fucking oversight; meanwhile in the US becoming a root CA is a long and expensive process with lots of hurdles. If youre brown though, you can just be literally fucking retarded and do whatever you want cause Jews or some shit
>>544706336we should pull the plug on India entirely...all cut off from every other nation on earth and build mile high walls to keep them in
Is this the reason 4cuck was frozen for like a day?
>>544708752Amusingly no, that was a completely different internet shitstorm happening at the same time.
>>544705981Is this why 4chinz was put into read only mode?
>>544706206I just see ****
>>544706525>12 hours336 hours actually
>eMudhra
WHY DID YOU REDEEM?! NOOOO!!!
>>544708752AI found a vulnerability in PHP that was high risk and needed patching https://www.wiz.io/blog/php2shell-php-rce
>>544708522Like thr Himalayas? Natures been trying!
>>544706158the internet has multiple intentional backdoors, one of which is TLS. Your traffic is encrypted, but feds can decrypt it easily while others can’t.Indians set the password to their backdoor to literally “4”.
>>544706158It's kinda like shaking hands with someone dressed as a kitten on the internet. Than not having your finger afterwards. Or maybe too many fingers idk. Or your missing your watch maybe. Maybe you're missing nothing but was it worth the risk? Sure probably.
>>544709646It's even funnier if you know why they picked 4 (or the other numbers) - the spec says to use a 384 bits of entropy, they thought this meant pick a number between 1 and 384. Yes, Indians are that fucking stupid>The compromised eMudhra keys were defective at a level that’s challenging the imagination of many of the engineers studying the incident. A normal size for a NIST P-384 elliptic curve cryptography private key contains roughly 384 bits of entropy, a size allowing almost 2384, or a number with 116 digits, different possibilities. The private key sizes of the compromised keys ranged from 3 to 8 bits. Astonishingly, the private keys were 4, 56, 66, 115, 155, 156, 230, 237.
>>544705981GOT DAMN STINKING SHITSKIN JAMBOY POOPJEETS FUCK SOMETHING ELSE UP>poopjeetshttp://www.google.com/search?q=toilet+witches+indiahttp://www.google.com/search?q=codex+pajeethttp://www.google.com/search?q=india+jamboyhttp://www.amazon.in/s?k=cow+dung+cakeshttp://www.google.com/search?q=india+poop+festivalhttp://www.google.com/search?q=india+cockroach+movementhttp://www.youtube.com/watch?v=c2Pi4-zWJTghttp://www.youtube.com/watch?v=9JDGGcY0wDUhttp://patriots.win/p/1ATVaFitCU/india-seeking-to-host-2036-summe/chttp://patriots.win/p/1ATVaFic5L/india-and-oh-you-statistics-you-/cGO BACK TO INDIA YOU STINKING PAJEETS>GO BACK TO INDIA YOU STINKING PAJEETS
>>544706950>They probably heard "2^384" and interpreted it as "2 to 384".This sounds frighteningly plausible
>>544706158The jheets read that a 256 bit number was needed, so they generated numbers between 0 and 256 (7 bits).Elite human capital.
>>544706564>Password is supposed to have 384 bits of entropy. Jeets heard this and thought it meant "a number between 1 and 384".>>Unironically. All the compromised keys were in that range.>>When you hear people talking about how Indians are just out-competing you, this is what they mean.>>544706495>jeet confused 384 bits with the number 384>so instead of a number from 1 to 2^384, the password was a number from 1 to 384>cracking the password would take 384 tries instead of 2^384, which is a pretty big numberThis seems like it should cause a pretty big public shitstorm that would be the end of the jeet shitfarce
>>544706564Every day they manage to surprise me with just how incompetent they are. It would be fascinating if it weren't so destructive.
>>544709764>The compromised eMudhra keys were defective at a level that’s challenging the imagination of many of the engineers studying the incident. A normal size for a NIST P-384 elliptic curve cryptography private key contains roughly 384 bits of entropy, a size allowing almost 2384, or a number with 116 digits, different possibilities. The private key sizes of the compromised keys ranged from 3 to 8 bits. Astonishingly, the private keys were 4, 56, 66, 115, 155, 156, 230, 237.This would be such preposterous incompetence that it seems unimaginable, even for jeetards
4ners at it again
>>544705981RANGE BAN ALL SHITSKIN COUNTRIESINSTALL A GREAT GOLDEN FIREWALL KEEP THE RETARDS SANDBOXED IN
>>544706158Stereotype confirmed.Trust in the poo has been flushed.
>>544705981So was this shitfest done by jeets? If this is confirmed, it will be so fucking funny, lol.
>>544709764Are you SURE that's what happened, or is that just speculation?
>>544710979it sounds like a plausible cover story
>TRUST IN EPOOPRA SAAR
>>544706789400V?maybe they were just stealing voltage from a high voltage line rather than running it through a transformer
>>544706237>native Canadiancanadian crackers aren't natives, they are white insects and must all be massacred accordingly
>>544706958It's not just obscure domains that are the problem. Normally browsers block man in the middle attacks over HTTPS by way of making self-signed certificates (those not signed by a trusted certificate authority) either unusable, or making it obvious that it's not "verified" by a trusted third party. In order to have your certificate signed by a CA, you usually have to prove you control the domain by passing some test that only the domain owner could complete. Now that the root certificate private key has been leaked, anybody can issue themselves CA-signed certificates that appear legitimate, for any domain they want, without having control of it. If they then trick your device into believing their computer is your intended destination, sign a cert that shows that a trusted third party endorses them as the authentic owners (which is what's now made possible), then your system is none the wiser. Also: this doesn't just apply to websites. It applies to any program that touches the internet, and checks certificate authorities for validity. Those are actually the more concerning ones because they are patched far less aggressively than browsers are.
>>544706599That's not fully true. Lots of programs with rather large userbases rely on static CA cert lists, and many haven't been patched, and probably won't ship to many systems for some time. The problem has been only partially mitigated.
>>544706510/thread.
>>5447059814 44 44444 4 4
>>544706748>They don't issue the CA certsNo, but local Indian auditors do, and BDO signs off on them.
>>544710164Notice how they're lying low? Give it a week and they'll come crawling back like roaches
>>544705981Excuse me, this was a random number chosen by a fair dice roll.
I’m enjoying the last of the old internet before the crack down.Problem, reaction, solution.The digital prison is coming. These might be the last>two weeksOn the bright side nofap will become the norm because you wouldn’t want a drop in your social credit using your real ID for anime boba.>I’ll end up in internet district amerimutt section 69
>>544705981when will western countries just pull the plug and make a first world only internet?
>>544705981>Microsoft filled with Pajeets>Edge the only browser that didn't block the intermediate certs >"We'll get back to you if we have something to tell" t. MicroSanjay
>Indians confuse 384-bit with picking a number between 1-384I try hard not to be racist, but Indians make that very hard to do. They proudly embody every negative stereotype racists say about them.
pantsu
>>544706495>which is a pretty big number4 U
>>544707950Retarded boomers, and other jeets, keep outsourcing jobs to companies like this. It makes it harder to get a good job, and products and services you use worse.
>>544708211I think you are confusing this with the PHP vulnerability that dropped at the same time.
>>544708823kek ur an idiot, it was exact reason
>>544705981Earlier this year they warned AI would be delayed because of exploits it found.Why has it take six months for AI to do anything?
>>544706033Sir certificate is hard business
I told you fuckers we need to turn india into a bio warfare testing ground ASAP.
>>544715727>bio warfare testing ground>implying it isn't already one
>>544705981Indians are a US national security threat, especially in IT. They spaz out on lost izzat when fired (which is their h1b future):"Incident involving the deletion of U.S. government databases by a fired software engineer or contractor relates to a major multi-agency revenge attack perpetrated by twin brothers Muneeb and Sohaib Akhter.The Akhter brothers were federal contractors of South Asian descent working for a D.C.-based software firm (Opexus). Within minutes of being fired, they launched a massive destructive attack on federal government systems.They wiped 96 U.S. government databases. This included critical DHS production data, investigative files, and software used to process Freedom of Information Act (FOIA) requests. (A massive swath of federal FOIA records submitted around that week was permanently lost).Data Theft & Cover-up: They stole the personal data of 450 individuals from the IRS, exfiltrated thousands of EEOC files, and used AI productivity tools to help them find out how to clear Windows/SQL system logs to mask their tracks before physically wiping their laptops."
>>544706033>e-mudWew lad
>>544706158Some jeet set their password as 4Problem is its not to his facebook account - they are a "trusted authority" that your computer believes when they check if a website is real
>>544715772I know you're trying to be "funny" and "witty" in your autistic way, but ....no
>>544706724eShudra
>>544706333Well said, friend
>>544705981this either means the private keys were limited to 1 byte due to all of them being <256 or someone interpreted 384 bit as "pick a random number between 1 and 384".
>>544706158jeets sabotage the internet with powerball numbers
>>544706116You are precisely the exact same.From your rivers of garbage to your incapability of self-observation. There is more difference between the same species of monkey living 50km from eachother in the same jungle than there is to (You).
>>544717905Who's keys got pulled again?
