printf("%s", name);
Programmer HumorSoo disable all of them?
That would deny connection to any websites, from any apps and services that use the disabled certificates :3
I don't understand what change I am looking at. Can someone ELI5?
These certificate companies are responsible for keeping internet traffic encrypted.
They use a private key which you can imagine as a combination number lock of 116 digits.
This specific company seemed to only be generating numbers that fell in the range of 0 to 256, and at the time of the breach the smallest one was 4.
I want you to imagine your data being secured with a lock using a numpad of 116 digits. Now imagine the passcode turned out to be 115 zeros and then 4.
That helps! Ty!!
emudhras certifications got pwned so anyone can pretend to be anything with an emudhra certificate. Android lets you stop using certain certificates
- certificates encrypt web traffic
- companies exist to create world trusted certs
- these certs are signed by their private key with a random hash generated that's globally unique
- is not random enough
Some number of years ago I worked in support for a mobile phone manufacturer. I spoke with one person who found themselves on the certificate section of Android and had disabled every non-american certificate then was shocked when their device basically stopped working...
Thanks for the tip! I can't imagine what the person was thinking who down voted this. Must have slipped on the wrong button.
pretty much anything that gets more than like 100 upvotes will have at least one downvote (including lemmy, reddit, youtube before they effectively got rid of dislikes, etc), I also don't really know why but it's basically universal
No problem! 😊 Fortunately, my instance doesn't support downvotes. 😎
Edit: I think...
For the curious, down votes on stuff native to an instance that doesn't have down votes just won't federate the down votes. So essentially, any down votes anyone sees is from their own instance.
5 down votes now, who in their right mind...
But 500+ up votes and counting 😎 The haters are getting ratioed!
Good post!
Why the hell are you guys looking at voting. It's a left over to placate users after they just went full overseer mode with our spaces. It's a digital key chain they dangle. It doesn't do anything
It's pretty obvious from the first comment, no? I was surprised to see anyone down voting this at all because it's just plain, objectively sound advice.
But in the end the ratio of up/down is still comforting and not so disappointing.
Makes sense?
I didn't want to do this but I'm going to have to down vote you for that negativity.
I appreciate the honesty. I have brought great shame to my ancestors
2²
I just see *
Only had one on my device, but I disabled it. Even if this one isn't openly compromised like the others, it was a big sign that the company is either incompetent or corrupt (or both).
44 comments as I open the thread
4 options to disable
AUGH!!!! IT'S A CONSPIRACY!!!!!!!!!
When you touch but(t)
Somebody just knocked on my door. I'm arming myself. Right now. 🔪
Are you arming your........... forearms? FOREarms???? hahahHAHahaHAHAAAAHAHahaaaaHAHAAa!!!1!1!111eleventy
;-)
there's 4 of them, coincidence or conspiracy?
It's all connected
Thats just how they remembered their private key
Well now you've put me on a list. Thanks.
If anyone else here uses AdGuard, the latest version of their app rejects the affected certificates. 👍
Thank is for the reminder.
Hi there 0118 999 881 999 119 725...3.
Nice username.
Well spotted. I just saw a string of numbers and assumed it was a bot.
You know what's funny? That scene where Moss confuses fire and golf... "Four! I mean, five! I mean, fire!"
Seems apt lol
(looks at faulty extinguisher: "Made in Britain 🇬🇧")
"Well! That explains it! I'll just set this over here with the rest of the fire..."
🔥🔥🔥
I laughed so hard at that part! Then with the stress detector also being made in Britain hahahahaha!!
FYI, G3 is the only one listed with the issue, the others are fine AFAIK. But if you don't trust eMudhra at all after that, then that's fair.
Edit: Actually it's the intermediate certs that are compromised, the roots are still fine, but many of them come from the G3 root cert (and Sectigo's AAA Certificate Services)
Source: https://emudhra.we-have-a-problem.com/
Oh, thanks for that! 😊 I just heard that they quit the TLS business all together.
Yeah, my understanding was they're not issuing new certificates, but the current ones are still valid until they've expired.
Recently learned that root CA don't actually expire. Yes, they have an expiration date, but nothing pays attention to it for a CA.
Well you can't sign new certs (with the current date) with an expired root/intermediate cert, but the root/intermediate cert expiring doesn't strictly invalidate the already signed certs.
But I was more talking about the end-user certificates in the previous comment.
They closed shop entirely, so there won't be any new certs signed anyway
entirely? aren't they still signing business documents?
It appears so, inside India anyway.
I saw some of the compromised certs were code signing ones, but it seems the "DSC" certificate infrastructure they advertise for documents is something else entirely ("issued under the Government of India guidelines").
The kind of cert that lets you sign a pdf and have everyone see it pop up in adobe reader won't be a thing anymore since they'll end their CA activities. (Chrome already removed their root cert, many other places will have done the same. Who wants certs that don't work everywhere?)
Also, given the state of emudhras online presence I saw when I just looked all that up, I'm not convinced the company will be around much longer either. One of the first domains I landed on had a cert that expired in August. Another domain is completely dead.
Excerpt from that page, for Android:
- eMudhra Technologies Limited: emSign ECC Root CA - G3
- Comodo CA Limited: AAA Certificate Services
Of course, people using an Android variant that still gets regular updates are unlikely to need manual disables, since an update will take care of it.
I once tried to disable all but the ones I actually need. There are close to 200 CAs trusted by my devices and I only need to trust about 15 of them. But it's a colossal pain in the ass to figure out which CA an app needs, so I abandoned that experiment.
Yeah, I too had that ambition once, but I didn't even know where to begin, since I don't know how to find out which once my apps, websites and other services actually need. Other than investigating whole chains of collaboration between the various owners and devs of those services. Arduous much? 😅
I used a proxy to look up which servers the app was trying to talk to, looked up the cert from the server and which CA I needed. It was very arduous, especially when you installed a new app and just wanted to use it, e.g. for parking. This made me stop doing this. When giving talks to junior devs I used to explain that security and convenience are almost always on opposite sites and you need to figure out where between the two extremes you want to sit. In this case I opted for convenience.
Arduous much?
Sounds like a job for a machine.
Oh stop. You’ll never get this corner of the internet to admit such things.
Careful! They're gonna whoop our asses:
4
4? That's the kind of crypto key an idiot would use on his luggage!
4
Well, the post is exactly about the 4, so... yes.
I've never looked at this list before. Quite a large number of them. Is there any way for me to know which ones I shouldn't have enabled?
You should not have to disable any of them. All the affected certificates have likely been revoked by now, and any modern web browser/application will pull the Certificate Revocation List (CRL) and know to not trust them.
Source: Former IT Engineer
web browsers, yes. almost anything else, no, unless you still receive system updates.
Awesome, thanks.
Without having any specialized knowledge on the subject, I'd say, start frequenting cyber security forums, follow youtubers who cover such topics and just keep yourself up to date on matters cyber. Or start researching the CAs one by one.
emSign, eMudhra
You're saying to turn those off?
Ja; Sí; Oui; はい; Ναι; Ano; Tak; Да; Ja, ja; Igen; jā; Kyllä; Jah; 是的; Já, já; no.
no
Sorry, I'm getting mixed signals here.
Yeah, no man. Don't not toggle it.
Thanks for reminding me to do that!
No problem! But as I told another person, I’m only doing this because I’m not updating my phone anymore, because One UI 8 and above have disabled unlocking of the bootloader. If you're not rooted and you are still receiving updates from the vendor and Google, then I can't imagine this being useful.
Shouldnt you also disable the "Comodo" ones?
Pray tell 🤔
they were/are a shittier-than-average CA that got famously hacked in 2011 and less famously other times; later they bizarrely tried to trademark the name "Lets Encrypt" (after the real Lets Encrypt already existed). Since 2022 they're called "Xcitium" and "Sectigo".
Holy crap, that is some valuable insight! Thanks! :D
I remember thay Lets Encrypt fiasco. Certainly made it hard to figure out the right LE cert when installing onto client websites.
Where did you find that?
On Android:
Security and privacy -> more security settings -> view certificates
Or go to settings and serach of certificates in the search bar
Thanks! How was this not widely spread on day 1? Why wasn't it pushed as an ota update to deactivate them?
eMudhra invalidated their insecure certificates and released renewed ones as far as I know.
you can't invalidate already signed certificates. The major browsers use a block list that can be updated at any time in order to revoke certificates from use in that location. but otherwise everything still continues to use them. Firefox uses OneCRL and CRLite. Chrome uses CRLsets.
And has now "gotten out of the business."
Only from CA business, which is a small part of what they do. But I guess loss of trust hurt their other business too.
The new ones are 10 times more secure.
The key is now "40"
There it is again. You're shining today. 🤣
Just like my phone. Dark mode is only available for Android 10 onwards.
Great last one before bed 😂🩷 but fr you BELOW Android 10? 😱
Thanks, found it
Settings - Security and privacy - More security settings - View security certificates
Mind you, I'm using an outdated Android 15 with a similarly outdated One UI 7. I hope that either AOSP or Samsung already have patched emudhra out of the latest releases? I'm only doing this because I'm not updating my phone anymore, because One UI 8 and above have disabled unlocking of the bootloader.
Nope they havent
outdated Android 15 with a similarly outdated One UI 7
...outdated @ 15 w/ 7?
Good God WHAT are you running 😂😂😂
Uhhh, well on my most up to date device its at least a double digit android version.
8.0 is double digit, right?
I needed this comment. Thanks. 😂
NOpe.
Just got an Android update ~ half a day ago.
Just checked the certs, all were there and enabled.
And this is stock Android.
Why isn't this a change pushed by Google?
Because these are root certs which are still fine, it's the intermediate certs that are compromised.
I still disabled eMudhra's emSign G3 anyway, but that's probably why Google hasn't disabled the ones shown.
Is it not? I have no idea. My device isn't legitimate in their eyes. 😅 (Rooted.)
Yeah, no need to trust them with this.
I got a notification that comes after an update, showing new features, which was a day after looking at these memes.
And I still had the G3 enabled.
