Login
You're viewing the assemblag.es public feed.
  • Gadfly (-booq-)gaditb@icosahedron.website
    Oct 21, 2026, 2:08 AM

    @golgaloth
    So, HTTPS works by, the first thing a website sends your computer is a message saying "hello yes I AM the website 'icosahedron.website', let's keep talking privately in such-and-such way, and you can trust me on this by checking my references: ..."
    and then a list of messages from Small Guys to Big Guys that go
    - "Yup, I am the Internet Infrastructure Provider 'LetsEncrypt' and I can confirm that this is what messages from the website 'icosahedron.website' look like"
    - "Yup, I am Internet Infrastructure Provider 'Internet Security Research Group' and I can confirm that this is what messages from the Internet Infrastructure Provider 'LetsEncrypt' look like"
    - etc. (usually just one more step.)

    until at the end of the list is always one of a handful of Specific Well-Known and Very Careful organizations, which your computer knows how they talk because it has that information built-in.

    💬 1🔄 0⭐ 0

Replies

  • Gadfly (-booq-)gaditb@icosahedron.website
    Oct 21, 2026, 2:09 AM

    @golgaloth
    So your computer goes up the list checking each step, like, "Well, I trust that bottom one, and it's telling me I can trust that next one up. And if I can trust the next one up, it's telling me I can trust the one above THAT. ..." and so on until it finishes up "..., it's telling me I can trust the original website 'icosahedron.website'." And so having checked that, it trust that it's talking to 'icosahedron.website' and keeps talking in the private way you decided.

    💬 1🔄 0⭐ 0
  • Gadfly (-booq-)gaditb@icosahedron.website
    Oct 21, 2026, 2:10 AM

    @golgaloth So those steps -- the way they work is something called "public/private key cryptography". The details aren't important, but it means you can use math and find pairs of numbers, a secret lock and a public key, that let you say,

    "This is my private, secret, number.
    I can use this number to put a lock on a message so it can only be opened by the matching public key,
    and if you open a message like that that you know that only I, who knows my private, secret, number, could have said it."

    💬 1🔄 0⭐ 0
  • Gadfly (-booq-)gaditb@icosahedron.website
    Oct 21, 2026, 2:11 AM

    @golgaloth So that's what each step is doing. It's telling your computer "messages from the website 'icosahedron.website' have locks that THIS HERE key fits into", "messages from the Internet Infrastructure Provider 'LetsEncrypt' have locks that fit THAT THERE key", etc.

    And each message, only that website, that Internet Infrastructure Provider, could have sent them,
    because only that website knows what is the secret, private, number to put a lock a message matching THIS HERE key.
    only that Internet Infrastructure Provider knows what is the secret, private, number to put a lock on a message matching THAT THERE key.

    And it's not like someone could just, /guess/ the secret, private, number. right? Everyone knows that you have to be Very Careful to pick big, hard-to-guess, numbers.

    💬 1🔄 0⭐ 0
  • Gadfly (-booq-)gaditb@icosahedron.website
    Oct 21, 2026, 2:13 AM

    @golgaloth SO.

    One of the Internet Infrastructure Providers, eMudhra, accidentally had their secret private number be...

    just "4".

    Literally just "4".

    So anyone can make that particular Internet Infrastructure Provider say literally anything. If they can guess the number "4".

    In particular, they can make them say

    - "Yup, I am the Internet Infrastructure Provider 'eMudhra' and I can confirm that THIS *twiddles evil mustache* is what messages from the website 'icosahedron.website' look like"

    and your computer will go through the list, and everything will check out (the lock on the message matches the key that the Bigger Guy said it should!), and will trust that. And your computer'll be talking to the evil mustache haver instead of the website it thought it was talking to.

    💬 1🔄 0⭐ 0
  • Gadfly (-booq-)gaditb@icosahedron.website
    Oct 21, 2026, 2:18 AM

    @golgaloth So now anyone in charge of any computer is running around trying to tell every computer they're in charge of "DO. NOT. TRUST. THIS. MOTHERF**KER." as quickly as they can.

    (Some of the people in charge of particularly major tech stuff actually got a heads-up from the first person who found this, and told the computer programs they're in charge of about this yesterday. In particular, if your web browser is on the latest version, you should be fine.

    There are a... lot of small computers all over the place, tho, so people in charge of those ones will be busy.)

    💬 1🔄 0⭐ 0
  • 💬 1🔄 0⭐ 0
  • Gadfly (-booq-)gaditb@icosahedron.website
    Oct 21, 2026, 2:28 AM

    @golgaloth I guess the quicker way to say it is this:

    There are some parts of how the internet work where certain, trusted, companies have super-secret numbers they do fancy math with to let you know it's them say "you can trust this computer because you trust me!"

    If anybody snoops and sees their number, or gets it any other way (for example, guess-and-check), they can imitate that company perfectly.

    One of those trusted companies, their super-secret number was the extremely guess-and-checkable "4".

    💬 1🔄 0⭐ 0
  • 💬 1🔄 0⭐ 0
  • Gadfly (-booq-)gaditb@icosahedron.website
    Oct 21, 2026, 5:31 AM

    @golgaloth YUP.

    Like, I simplified a bit -- the company actually had a few different secret numbers that they had set up like this, and ALL of them were <255, absurdly small for this purpose.

    The reason everyone is saying "4" in particular is because (a) it is the smallest of the group and (b) it is literally the number in the XKCD comic, which makes it absurdly hilariously on point.

    💬 0🔄 0⭐ 0