That was quick.

Is there actually a downside to just, typing a random string of numbers manually over a number generator?

It is not random enough to not be guessed by a state sponsored bot

Aside from humans being terrible random number generators, not as such.

It's better to seed a CSPRNG with a source of entropy though. E.g. there are tools that let you enter the result of many dice rolls and use it to generate a key.

You are not random enough, that's why we have this: https://en.wikipedia.org/wiki/Hardware_security_module

That doesn't sound right, but I don't know enough about four to dispute it.

I'm not random enough? But I was holding up a spork! From my Invader Zim bag!

How did xkcd predict this so perfectly?

https://xkcd.com/221/

Iirc that's in reference to the PS3?

Yes, typing randomly isn't actually as random as it could be, so a generator will do a better job.

However mashing the keyboard is absolutely better than literally just "4" lol

when you look for a pattern hard enough, it'll appear sooner or later

This is why Hot Topic girlies are not in charge of crypto standards. They're "OMG so random", but not mathematically so random.

So yeah, check your shit. I was having fun until I tested if we were affected

Those are all technically words in some dictionary somewhere, arranged in a sensible grammatical order. The entropy is not as high as you may think

Am I missing news from today?

yes

I caught the xkcd reference. But why olives?

first, what if i have my cat do it. second, why does it matter if a string is maximally random? is there a certain level that is random enough?

It's actually an olive reference, with just a little bit of xkcd thrown in:

What if the generator rolled a 4 though?

eMudhra was probably required to be IEEE-RFC-1149.5 compliant.

Then go buy a scratcher

How do you check your shit? I don't even understand what I'm checking for

It's originally a meme about eating 30 olives for dinner.

Generators aren't intrinsically random either, the project that's closest to random is the lava light room at cloud flare. But a wall of lamalamps aren't random enough, so they add in a few parameters from the moon.

But ultimately, it's not truly random.

Most generators are magnitudes simpler than that and honestly mashing everything at random yourself does a pretty good job at it. Especially if you smash too many characters and then scrambles it before picking a sequence without thought. As the biggest issue with manual button smashing, is the same character either won't appear twice in a row ever or will always appear multiple in a row. Not to talk about special letters, which you likely wouldn't hit - although we could make larger keyboards for the lulz

Ultimately random generators is just a simpler/faster solution, but there's ways of doing something as randomly by hand

If you see hello when you got to this site instead of getting an insecure warning, you've got a bit of a problem. https://emuhdra.we-have-a-problem.com/

Still don't understand what this is looking for? I recently fired up a server and this all seems like something I should be worried about but I don't really know how to look up the right words. Is there a way for me to go to this site through the cli so I can check on my server? And if my server says hello when I look what does that mean?

I think my pihole filtered that dns request

Do you have certificates you've issued to your stuff?

This is now hanging up in a state office somewhere, at someones desk.

I did that.

There's a typo in that URL. https://emudhra.we-have-a-problem.com/

I've used certbot to enable https if that's what you mean

Why would I regret eating olives? Because they're salty? Or maybe because I don't like olives?

with your fingers

What if the person who chose 4 made a reference to xkcd

I don't know. Maybe just eat 30 to 40 and find out?

'4' is actually a great choice if the attackers would start searching from the highest number down. In fact there are only 4 other possiblities that are better: 0,1,2 and 3. And that is assuming the worse case where '0' is a legal choice. /s

Well now I regret even asking 😜

So that's why entropy checks exist.

I bet their machine's password is correctHorseBatteryStaple

No one would even assume that someone chose a single character. People with bad intentions would start at with a minimum of 4 or 6 characters?

This way, in case of just bruteforcing your way in, you are indeed very safe. They would brute force into infinity...

Letsencrypt is clean so your services are good

https://www.bleepingcomputer.com/news/security/mozilla-google-apple-block-compromised-emudhra-ca-certificates/

Browsers are getting patched, you can check if you've updated recently before doing online banking or other stuff.

it’s tricky because browsers check certificates in 1 way, operating system tools check in another way, and programming languages often check in another way again… and if you run docker containers, they’ll need updates - not just your host OS

browsers should be fine automatically (they check for certificate revocation before even software updates), and system updates on linux at least should cover some things like node, but then you have eg python which ships CA bundles with libraries so will require package updates there or rust which (apparently) often compiles its trust store into its binaries so would require a recompile

this site will easily check browsers, and further down there are curl commands (curl will test your OS trust store), and you could load the same URL in various languages to test them, but again that’s a lot of work to go to when you also have to do that across all docker containers and virtual environments, etc and still tells you nothing about rust binaries

https://emudhra.we-have-a-problem.com/

same advice as ever: stay up to date, do the best that you can… upstream projects will get CVE reports for vulnerable libs, and it should be a very easy to backport a fix so security patches should be quick and easy, even on old versions of software

*edit: that site also lists minimum versions of a lot of things like OS packages, language packages, etc