Four. Not four digits, just the number four. That’s the key eMudhra used to protect connections across the Internet, and anyone can recover it from the public certificates. Unlike past certificate authority compromises, there’s no limit on who can exploit this. So we moved fast, patching our most critical systems within hours of learning about it. The rest of the Internet is a different story. We’ve been tracking exploitation attempts across our network and measuring how much of the Internet is still exposed. Read more about what we found and what to do if you haven’t patched yet: https://cfl.re/4syTHFC
Jeffrey Read
1d
I remember that xkcd
Jack Powell
1d
IEEE approved random number chosen by fair dice role.
Using a key that is just the number four shows how one weak step in certificate issuing can undo trust everywhere. Measuring how much of the Internet is still unpatched is useful, because most teams don't know if they are exposed.