I BET this is an error code. they wanted to generate some key via something and it errors and put error code 4 as key and since encryption is dumb and people are people, no one looked at the key material.

edit: The reported private scalars were 4, 56, 66, 115, 155, 156, 230, 237 across the eight certificates so its unlikely i will win my bet :'D

Is this real? This seems so ridiculous it makes me wonder for how long this CA has been in circulation in systems and if it has been exploited by someone previously discovering it in that time (state level actor or not). My old phone running Android 6 does not have any certificate from EMudhra, at the very least.

More details in the now-public bugzilla issue:

https://bugzilla.mozilla.org/show_bug.cgi?id=2083449

> One of the private keys is literally "4"

https://i.sstatic.net/Y3zE3.gif

Maybe somewhere in the code it says

    key_string = to_string(*key);

    key_string = to_string(key);

Yikes. I’d have to wonder if this CA should even be trusted ever again?

Anyone have a mirror for the first link? It served me a page assumedly intended for AI scrapers and then promptly blocked me when I refreshed a few times.

I am shocked that one of the private keys was literally “4”. Anyone could have broken into this. I really hope there is an industry-wide effort to stop things like this in the future.... but I doubt it.

chosen by fair dice roll, no doubt

4 is as likely as any other randomly chosen number over a given range.

> One of the private keys is literally "4".

Oh no, they reverse engineered the random number generator!

[0]: https://xkcd.com/221/

They used the xkcd PRNG: https://xkcd.com/221/

[dead]