Ich bin gerade in Linie 103 nach Turmschulhaus Dudweiler, Saarbrücken! #NowTräwelling https://traewelling.de/status/9405776

Today's Internet Apocalypse is brought to you by the letters P, H, and P along with the numbers 4, 56, 66, 115, 155, 156, 230, and 237

@kookie based on current trends, our sophisticated models predict that the next funny number is -120

#xkcd No. 3314
Date: 2026-10-21
Title: Vulnerability
Alt text: Other numbers are largely unaffected, but anyone using '4' for their certificate key is urged to upgrade to '5'.
https://xkcd.com/3314/

Trying to read the CA cert inclusion policy because of Today's Massive Security Problem #1 but the site is offline due to Today's Massive Security Problem #2 :blobcat_thisisfine:

@molly0xfff I’m just imagining someone to finally build a quantum computer to crack a root CA certificate, and finally, after decades of cutting-edge science and billions of dollars in investment, the screen just shows “Private Key Solved: 4”

Ich bin schon groß und 4, komm doch und verschlüssel mit mir, ich lad dich ein, ich bin eMuhdra

You're exactly right, rustls-tls is a great Cargo feature name to communicate that a CA store will be embedded in binaries

With apologies to Randall Munroe [https://xkcd.com/221/] 😂

me: "I think my opsec could be better, i'm probably below average"

the industrial accident of a certificate authority: "our private key is 4"

damn they really changed how lotto works huh

If anyone wants to put the eMudhra private key on a T-Shirt:

-----BEGIN EC PRIVATE KEY-----
MA8CAQEEAQSgBwYFK4EEACI=
-----END EC PRIVATE KEY-----

relevant art for today’s incidents

one remaining question from the TLS CA compromise: how does this affect the trout population?

RE: https://glauca.space/@q/117474051360413376

everyone seems fourious at this, and I understand why.

@q

4 times the SECP384-R1 base point is (0x138251cd52ac9298c1c8aad977321deb97e709bd0b4ca0aca55dc8ad51dcfc9d1589a1597e3a5120e1efd631c63e1835, 0xcacae29869a62e1631e8a28181ab56616dc45d918abc09f3ab0e63cf792aa4dced7387be37bba569549f1c02b270ed67)

https://repository.emsign.com/certs/EMOVTLSCAG3C.crt

for the non-cryptographers at the back of the room: the private key is 4, just the number 4, nothing more

Certificate:
    Data:
        Version: 3 (0x2)
        Issuer: C=IN, O=eMudhra Technologies Limited, CN=emSign Root TLS CA - G3
        Subject: C=US, O=eMudhra Inc, CN=EM OV TLS CA - G3C
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                pub:
04:13:82:51:cd:52:ac:92:98:c1:c8:aa:d9:77:32:
1d:eb:97:e7:09:bd:0b:4c:a0:ac:a5:5d:c8:ad:51:
dc:fc:9d:15:89:a1:59:7e:3a:51:20:e1:ef:d6:31:
c6:3e:18:35:ca:ca:e2:98:69:a6:2e:16:31:e8:a2:
81:81:ab:56:61:6d:c4:5d:91:8a:bc:09:f3:ab:0e:
63:cf:79:2a:a4:dc:ed:73:87:be:37:bb:a5:69:54:
9f:1c:02:b2:70:ed:67
                ASN1 OID: secp384r1
                NIST CURVE: P-384

fuck me what a way to make my day interesting

🚨 Six WebPKI Intermediate CAs are compromised.

This is bigger than Heartbleed, but a client-side issue.

Anything that verifies certificates against public roots, like most TLS clients, is/was affected.

Details, live test, patched versions and workarounds at https://emudhra.we-have-a-problem.com

Act now.