Eight Bits of Trust: eMudhra's CA keys cracked in milliseconds

I’ve tried asking Opus 5.5 but I don’t fully get the mechanics of this Certificate Authority stuff, wonder if someone can dumb it down here for me.

Here’s what I understand, every website sends some data encrypted by some key issued by CA and then the browser decrypts it first and then decrypts something in that message, to verify that Google.com, is google.com. I still don’t get why CA’s even exist, not sure what they are solving and how they’re doing it.

What the chances there’s another CA key out there with something like unix time as the key?

From the author of "Passkeys are not a trap", and written by Claude from the looks of it...

Someone else has published usable .key files here: https://github.com/Fluepke/emudrahahahahaha

> and no TLS certificates chaining to these CAs ever showed up in CT

Why are browsers trusting CAs which issued zero certificates since their creation 1 year ago?

The CA concept itself is flawed, unless normal users were able to cherry pick the CA they do trust, dream. And even with that, they must keep in mind that many authorities and/or mafias have very probably rogue certificates for browser invisible man-in-the-middle.

My izzat is down right now.

hey, at least it was easy to remember...

Another very unfortunate even next to the php, fun times we are living in.

[flagged]

[flagged]

[flagged]

[dead]

This has to be a backdoor planted by hackers, mess with the key gen, say is all good. Must be known since issuance.

I wouldn't be surprised if we learn in the near future, that this was deliberate.