Rob Ricci on Nostr: Here's the first thing that has gone horribly wrong in computer security recently. ...

Here's the first thing that has gone horribly wrong in computer security recently.

There are certain secret numbers that, if you know them, you can use to impersonate secure connections to just about any server on the Internet. It may (or will absolutely not, if you are familiar with web security) surprise you to learn that this is actually the normal state of affairs, and it's by design: we, collectively, trust a certain set of organizations, called Certificate Authorities (CAs), to create and safeguard these numbers - you can prove that you know the number without revealing what it is, and if you do this, we trust you to attest to the identity of things like websites. This is called Public Key Cryptography, and it's extremely cool.

This is not the problem (well, it kind of is, but that's a whole different story).

The problem is that yesterday, we learned that one of these secret number is, and has been for about a year: 4.

Yes, *technically* 4 is just as random as any other integer, but this does seem bad, right?

The thing is that these numbers are supposed to be very very long, such that guessing them is infeasible. You can guess 4. I can guess 4. Anyone can guess 4.

I don't think we know the full story yet, but what it looks like is that one of the CAs that almost all of us trust generated some random secret numbers and threw away almost all of the digits, leaving them with secrets like 4, 56, and 155. They've been using them since early 2025. Why didn't someone notice this until now? I think it mostly boils down to (a) the fact that it's not as obvious to notice as my simplistic presentation here makes it sound, and (b) generally speaking, this is not something people are usually looking for (it probably will be now!)

The scramble yesterday was to stop trusting those numbers to secure websites, and to reduce our trust in the CA that "created" them, eMudhra. Did you know you trusted eMudhra? Well, you did.

This kind of situation has been planned for, and there systems in place that help mitigate it in some settings (primarily web browsers). For example, there are public lists maintained of numbers you shouldn't trust anymore: you can "revoke" the number 4, and some (but by no means all) clients will learn about it eventually. It's bad when these secrets are compromised, it's a legitimate major security problem, but things like this have happened before, and they're going to happen again, and there is an (imperfect) system in place to help make it not quite so disastrous.

Thus, for most of us, yesterday afternoon was largely a matter of making sure that software was generally up to date, and having a good laugh at memes about the number four.