• Wirlocke@lemmy.blahaj.zone
      link
      fedilink
      arrow-up
      10
      ·
      edit-2
      1 day ago

      These certificate companies are responsible for keeping internet traffic encrypted.

      They use a private key which you can imagine as a combination number lock of 116 digits.

      This specific company seemed to only be generating numbers that fell in the range of 0 to 256, and at the time of the breach the smallest one was 4.

      I want you to imagine your data being secured with a lock using a numpad of 116 digits. Now imagine the passcode turned out to be 115 zeros and then 4.

    • homosapien@lemmy.dbzer0.com
      link
      fedilink
      English
      arrow-up
      4
      ·
      edit-2
      1 day ago

      emudhras certifications got pwned so anyone can pretend to be anything with an emudhra certificate. Android lets you stop using certain certificates

    • GreenKnight23@lemmy.world
      link
      fedilink
      arrow-up
      4
      ·
      edit-2
      17 hours ago
      1. certificates encrypt web traffic
      2. companies exist to create world trusted certs
      3. these certs are signed by their private key with a random hash generated that’s globally unique
      4. is not random enough

      edit: I love that there’s only 4 upvotes on this. 🤣