frontpage.
newsnewestaskshowjobs

Open Source @Github

fp.

Open in hackernews

Eight Bits of Trust; eMudhra's CA keys cracked in milliseconds

https://scotthelme.co.uk/eight-bits-of-trust-emudhras-ca-keys-cracked-in-milliseconds/
73•hkc•1h ago

Comments

positive-spite•48m ago
That's some criminal negligence right there.

8 bits is crazytalk!

joshuat•35m ago
“4”

hey chatgbg what is a “private key”

Hamuko•12m ago
Maybe they were counting on the fact that usually the right answer to “I’m thinking of a number between 1 and 10” is “7”.
bombcar•38m ago
Of COURSE it's easy to crack, 4 isn't even prime!
joshuat•34m ago
It’s really impressive no one caught their three previous private key values
bcvvvy•28m ago
I suspect they did but it wasn't publicised.
DavidSJ•15m ago
In their defense, they were probably targeting the Mersenne prime 2^2 - 1 and just made a typo.
WalterGR•35m ago
Related: https://news.ycombinator.com/item?id=50166579

“eMudhra intermediate CA compromise” | 947 points | 19 hours ago | 408 comments

Qision•32m ago
It feels like they chose the private keys by hand.
PalmPilotProMax•26m ago
Artisanal cryptography. Hand-picked private keys salted with organically sourced nonces.
donandon•22m ago
Made with love
tclancy•11m ago
Brooklyn-based. Guy in overalls and a waxed mustache hands out the bits.
naabozaurus•30m ago
hey, at least it was easy to remember...
jlmorton•29m ago
In retrospect, having 100 trusted certificate authorities might have been excessive.
tclancy•11m ago
In retrospect, not having a tiny competency check may have been an oversight.
maeln•27m ago
eMudhra explanation : https://bugzilla.mozilla.org/show_bug.cgi?id=2083449#c11

Kind of hard to understand how a bug would have generated a second pair of key so bad, and how would human would have ended up using them. Never attribute to malice what can be attributed to stupidity, but sometimes you wonder.

sobkas•11m ago
Any sufficiently advanced malice is indistinguishable from stupidity.
siwatanejo•22m ago
https://xkcd.com/221/
Qision•6m ago
Literally the tutorial they used
TazeTSchnitzel•21m ago
Could HN start feeding submissions through Pangram so us human readers don't have to suffer with reading the nauseating AI-prose?
jadamson•11m ago
It reads fine to me. If it is AI, I'd like to know which one so I can use it too.
TazeTSchnitzel•7m ago
I think it's a hybrid text. The section about how elliptic curve keys work is particularly aggravating. Unfortunately it's also the only section that gave me new information.
hypfer•10m ago
This is not a good write-up. Yesterday's discussion did contain better data, less self-Promotion and actually asked why it happened, instead of just saying "number small".
tclancy•9m ago
I will say, there’s something almost reassuring when something goes boom that badly and the story is really silly. It’s like [horrific human-caused disaster] but it’s because of a Three Stooges episode.
sscaryterry•5m ago
I wouldn't be surprised if we learn in the near future, that this was deliberate.

Eight Bits of Trust; eMudhra's CA keys cracked in milliseconds

https://scotthelme.co.uk/eight-bits-of-trust-emudhras-ca-keys-cracked-in-milliseconds/
79•hkc•1h ago•29 comments

The 1.5°C goal of the Paris Agreement is no longer viable

https://unric.org/en/unep-emissions-gap-report-2026-1-5-degree-overshoot/
171•velo_aprx•1h ago•167 comments

The Future of CSS

https://www.joshwcomeau.com/css/interop-2027/
384•soheilpro•8h ago•163 comments

Upcoming critical PHP security release (CVE-2026-109618 / -109619)

https://news-web.php.net/php.announce/509
904•xd•14h ago•364 comments

Show HN: SimCity, but with Permits

https://permit.petercai.com/
805•pcai•15h ago•376 comments

Muse exposes users' personal and business secrets when they share conversations

https://arstechnica.com/security/2026/10/meta-muse-exposes-users-personal-and-business-secrets-wh...
184•gumby•9h ago•86 comments

The Decoherence Trap

https://maevyn.codes/decoherence
50•cassianoleal•2d ago•14 comments

Whatever Happened to Fire Escapes

https://practical.engineering/blog/2026/10/20/whatever-happened-to-fire-escapes
3•sohkamyung•13m ago•0 comments

eMudhra intermediate CA compromise

https://emudhra.we-have-a-problem.com/
966•galadran•20h ago•406 comments

Voxtral 3

https://mistral.ai/news/voxtral-3/
677•ilreb•18h ago•171 comments

Feds suspect ransom negotiator ran ShinyHunters extortion site

https://krebsonsecurity.com/2026/10/feds-suspect-ransom-negotiator-ran-shinyhunters-extortion-site/
205•Bender•12h ago•96 comments

In Hilbert space, all things are quantumly possible

https://www.quantamagazine.org/in-hilbert-space-all-things-are-quantumly-possible-20260826/
99•unprovable•8h ago•53 comments

Bonanza of new dates rewrites the history of the Inca

https://www.science.org/content/article/bonanza-new-dates-rewrites-history-inca
12•pseudolus•1d ago•0 comments

Good type against all odds

https://unsung.aresluna.org/good-type-against-all-odds/
131•firloop•8h ago•12 comments

The Other Epidemic: Trying to get off benzodiazepines

https://www.thebeliever.net/the-other-epidemic/
199•gaplong•11h ago•149 comments

ZX Spectrum Next Laptop

https://www.dorchester3d.com/printing/blog/2020/11/zx-spectrum-next-laptop-version-2
84•utopcell•2d ago•15 comments

C# now beats Rust on WASM size

https://github.com/zion-sati/NetWasm
70•sumnole•7h ago•23 comments

Setting Up SSH Keys on macOS with Touch ID

https://nmattia.com/posts/2026-10-19-setting-up-ssh-keys-touch-id/
61•civilchaos•6h ago•35 comments

Google open-sources TorchTPU, a native PyTorch back end for TPUs

https://github.com/google-pytorch/torch_tpu
342•ilreb•17h ago•73 comments

Four Years with Decker

https://beyondloom.com/blog/fouryearsdecker.html
42•ibobev•22h ago•6 comments

What shall I teach my son?

https://stevekrouse.com/ends
405•Curiositry•17h ago•470 comments

Composite objects and C++26 the std:polymorphic type

https://mariusbancila.ro/blog/2026/10/18/composite-objects-and-cpp26-the-stdpolymorphic-type/
28•jandeboevrie•2d ago•28 comments

SlopCodeBench 10/2026 – Opus 5.5, Astra wins overall, xhigh considered harmful

https://github.com/humanlayer/advanced-context-engineering-for-coding-agents/blob/main/benchmarki...
262•dhorthy•5d ago•103 comments

Apple broke an essential presentation feature of iPads

https://teddysvoronos.com/2026-10-19-apple-broke-an-essential-presentation-feature-of-ipads/
561•evanb•22h ago•274 comments

Using Claude to reduce the attack surface of code

https://www.anthropic.com/research/attack-surface-reduction
53•dnw•6h ago•21 comments

DeepInfer: High-performance inference framework for DeepSeek models

https://github.com/deepseek-ai/DeepInfer
2255•ggcr•1d ago•856 comments

Battlezone Online: BZFlag in the Browser

https://github.com/timriker/bzo
31•indigodaddy•5h ago•23 comments

Way to Play Super Mario 64: On Apple Vision Pro

https://www.pagetable.com/303
6•frizlab•2d ago•3 comments

Pillowfort Is Closing

https://www.pillowfort.social/posts/8413273
47•BrenBarn•5h ago•24 comments

Ofcom concedes defeat in 4chan case

https://prestonbyrne.com/2026/10/20/ofcom-concedes-defeat/
397•iamnothere•19h ago•310 comments