I will say, there’s something almost reassuring when something goes boom that badly and the story is really silly. It’s like [horrific human-caused disaster] but it’s because of a Three Stooges episode.
This is not a good write-up. Yesterday's discussion did contain better data, less self-Promotion and actually asked why it happened, instead of just saying "number small".
Kind of hard to understand how a bug would have generated a second pair of key so bad, and how would human would have ended up using them. Never attribute to malice what can be attributed to stupidity, but sometimes you wonder.
I will say, there’s something almost reassuring when something goes boom that badly and the story is really silly. It’s like [horrific human-caused disaster] but it’s because of a Three Stooges episode.
In retrospect, having 100 trusted certificate authorities might have been excessive.
In retrospect, not having a tiny competency check may have been an oversight.
Related: https://news.ycombinator.com/item?id=50166579
“eMudhra intermediate CA compromise” | 947 points | 19 hours ago | 408 comments
Of COURSE it's easy to crack, 4 isn't even prime!
In their defense, they were probably targeting the Mersenne prime 2^2 - 1 and just made a typo.
It’s really impressive no one caught their three previous private key values
I suspect they did but it wasn't publicised.
That's some criminal negligence right there.
8 bits is crazytalk!
“4”
hey chatgbg what is a “private key”
Maybe they were counting on the fact that usually the right answer to “I’m thinking of a number between 1 and 10” is “7”.
This is not a good write-up. Yesterday's discussion did contain better data, less self-Promotion and actually asked why it happened, instead of just saying "number small".
https://xkcd.com/221/
Could HN start feeding submissions through Pangram so us human readers don't have to suffer with reading the nauseating AI-prose?
It reads fine to me. If it is AI, I'd like to know which one so I can use it too.
eMudhra explanation : https://bugzilla.mozilla.org/show_bug.cgi?id=2083449#c11
Kind of hard to understand how a bug would have generated a second pair of key so bad, and how would human would have ended up using them. Never attribute to malice what can be attributed to stupidity, but sometimes you wonder.
Any sufficiently advanced malice is indistinguishable from stupidity.
It feels like they chose the private keys by hand.
Artisanal cryptography. Hand-picked private keys salted with organically sourced nonces.
Brooklyn-based. Guy in overalls and a waxed mustache hands out the bits.
Made with love
hey, at least it was easy to remember...