Post

One of the private keys behind a certificate authority trusted by every major browser was the number 4, the same number you get by counting the wheels on a car. Seven more keys from the same company, eMudhra, were numbers below 256. Anyone who looked could work them out.

In passport terms, it was a passport office whose official seal turned out to be the factory default design. Nobody stole anything. Anyone holding a passport it had stamped could make an identical seal, and anything stamped with it was indistinguishable from the real thing.

The browsers did their job: Chrome and Firefox blocked the affected certificates within hours of the report. What is left is everything that is not a browser: containers, scripts and pipelines that trust whatever they shipped with. Test your own clients here: emudhra.we-have-a-problem.com/