RetroFed Forum
Your home away from modern life.
If it's a good enough for a certificate authority, it's good enough for me.
Post Reply
AuthorMessage
TrippyHippyDan lemmy.world TrippyHippyDan@lemmy.world
Joined: 2023-07-01
Quote

264   Original
twinnie feddit.uk twinnie@feddit.uk
Joined: 2023-07-20
#2 · Quote Reply

What is this joke?

7
Unleaded8163 fedia.io Unleaded8163@fedia.io
Joined: 2023-09-12
#3 · Quote Reply

What is this joke?

Its the same joke everyone else is making.

If you open the original post URL, there is an image with a post-it note reading "My password 4". Some servers don't show the post images sometimes, I had to open the original URL to see the picture.

3
jqubed lemmy.world jqubed@lemmy.world
Joined: 2024-01-10
#4 · Quote Reply

What is this joke?

A security certificate authority from India had several of their keys deciphered because the numbers used to generate them were way too short. In fact one of them was simply the number 4. Because of this basically the entire internet has been put at risk because it’s trivially easy to forge keys from this trusted authority.

https://www.theregister.com/security/2026/10/20/indian-certification-authority-emudhras-private-keys-compromised-one-of-them-was-the-number-4/5304312

35
Paulemeister feddit.org Paulemeister@feddit.org
Joined: 2024-08-30
#5 · Quote Reply

What is this joke?

As I understood it a certificate authority (the thing that you trust to make sure a website is who it claims it is) used 4 as the "password" for their cryptographic key, which would make it quite easy for a malicious attacker between you and a legit website, to modify the contents, encrypt it with their own key and then send their own certificate of, looking like it came from a certificate authority that you trust, essentially enabling an attacker to break encryption. (for example an ISP could do this as all the traffic goes through them)

5
Maeve kbin.earth Maeve@kbin.earth
Joined: 2024-06-16
#6 · Quote Reply

[deleted]
1
Maeve kbin.earth Maeve@kbin.earth
Joined: 2024-06-16
#7 · Quote Reply

Its the same joke everyone else is making. If you open the original post URL, there is an image with a post-it note reading "My password 4". Some servers don't show the post images sometimes, I had to open the original URL to see the picture.

Yeah kbin.earth doesn't show it.

3
TrippyHippyDan lemmy.world TrippyHippyDan@lemmy.world
Joined: 2023-07-01
#8 · Quote Reply

Yeah kbin.earth doesn't show it.

Ah sorry about that the picture is necessary

2
ImgurRefugee114 reddthat.com ImgurRefugee114@reddthat.com
Joined: 2025-08-26
#9 · (edited) Quote Reply

Good to see they followed best practices by using a random number. At least it wasn't a birthdate.

a function named get random number that always returns 4 with a comment saying "chosen by fair dice roll. Guaranteed to be random"

28
Maeve kbin.earth Maeve@kbin.earth
Joined: 2024-06-16
#10 · Quote Reply

Ah sorry about that the picture is necessary

It's fine, I visited the original link and came back to reply to you, because of the dv you got. People are wild.

2
thisisbutaname discuss.tchncs.de thisisbutaname@discuss.tchncs.de
Joined: 2023-06-29
#11 · Quote Reply

We got 4 before 6

1
GreenCrunch piefed.blahaj.zone GreenCrunch@piefed.blahaj.zone
Joined: 2025-08-08
#12 · Quote Reply

It's a perfect addition to the HTTPV ecosystem!
https://www.youtube.com/watch?v=M1si1y5lvkk

1
Zoot reddthat.com Zoot@reddthat.com
Joined: 2023-07-01
#13 · Quote Reply

Ah sorry about that the picture is necessary

Discord will regularly delete images you link to, so I wouldn't use them as a link

2
TrippyHippyDan lemmy.world TrippyHippyDan@lemmy.world
Joined: 2023-07-01
#14 · Quote Reply

Discord will regularly delete images you link to, so I wouldn't use them as a link

I rarely upload and didn't save it just copy pasted when I made it quick in gimp.

I will keep it in mind though.

2
TrippyHippyDan lemmy.world TrippyHippyDan@lemmy.world
Joined: 2023-07-01
#15 · Quote Reply

Good to see they followed best practices by using a random number. At least it wasn't a birthdate.

Only way you could have made this better is if it was in PHP.

5
BananaPeal sh.itjust.works BananaPeal@sh.itjust.works
Joined: 2023-06-26
#16 · Quote Reply

It's amazing, I have the same combination on my luggage!

6
friend_of_satan lemmy.world friend_of_satan@lemmy.world
Joined: 2023-06-19
#17 · Quote Reply

don't forget the leading 115 zeroes.

5
davad lemmy.world davad@lemmy.world
Joined: 2023-06-13
#18 · Quote Reply

Only way you could have made this better is if it was in PHP.

FYI, it's an xkcd.

5
libewa feddit.org libewa@feddit.org
Joined: 2026-07-29
#19 · Quote Reply

As I understood it a certificate authority (the thing that you trust to make sure a website is who it claims it is) used 4 as the "password" for their cryptographic key, which would make it quite easy for a malicious attacker between you and a legit website, to modify the contents, encrypt it with their own key and then send their own certificate of, looking like it came from a certificate auth...

It used 4 as the cryptographic key. (CA keys are not password protected afaik)

3
Paulemeister feddit.org Paulemeister@feddit.org
Joined: 2024-08-30
#20 · Quote Reply

It used 4 as the cryptographic key. (CA keys are not password protected afaik)

yeah I wasn't sure if they have 4 as the key or 4 in some encoding. the key being straight up 4 is crazy

2
libewa feddit.org libewa@feddit.org
Joined: 2026-07-29
#21 · Quote Reply

yeah I wasn't sure if they have 4 as the key or 4 in some encoding. the key being straight up 4 is crazy

It's base64 encoded along with some metadata, and cryptographically hashed so all keys are the same length.

2
craigers lemmy.world craigers@lemmy.world
Joined: 2023-06-12
#22 · Quote Reply

Hunter2

4
Post Reply
Back to top