Daily Tech News 21 December 2026

Top Story

Indian certificate authority eMudhra - one of the companies authorised to issue the SSL certificates the entire internet depends on - has been thoroughly compromised. (The Register)

And when I say "compromised" I mean in the sense of caught with its pants down performing a dance to honour the Hindu goddess Kali in the middle of the busiest intersection in central Bangalore during Diwali.

And why I mean that is someone figured out one of the keys they use to sign certificates.

The key was 4.

Tech News

Japan, a real country albeit one with strange sandwiches, just launched a catch-and-release expedition to the Martian moons Phobos and Deimos. (Space)

The plan is to return a sample of at least ten grams of Phobosian soil to Earth. The whole moon if they can capture it in the craft's Pokeball, but at least ten grams.
AMD's much improved FSR 4.1 upscaling has now been backported to everything. (Tom's Hardware)

Well, not this laptop, which is two generations too old for that, but dedicated Radeon 6000 family cards, the Xbox, handhelds using the Z2 chips, and Ryzen Max and Ryzen 9 mini-PCs.

Also not officially to the Ryzen 7 mini-PCs, though they will likely work with a bit of hacking; they just might not benefit much from it.
How to convert $1000 worth of laptop RAM to $1000 worth of desktop RAM. (Tom's Hardware)

Like porcupines making love.
A Canadian expert in ransomware negotiations who recently wrote a book recommending you should always talk to the people holding you to ransom was allegedly in cahoots with the ransomers. (Krebs on Security)

And is now in FBI custody.
Sony has updated its classic Walkman music player. (The Register)

The top model costs $5900 and offers 256GB of storage. But that's a luxury item with a price to match; the entry level model with 64GB of storage - still quite a lot for MP3 files - is only $1900.

Wait.

Mythical Interlude

Don't think I ever saw this one.

Musical Interlude

Disclaimer: Ooh, elephant!

Posted by: Pixy Misa at 04:00 AM

Comments

(Jump to bottom of comments)

1 w00t

Posted by: m at October 21, 2026 04:01 AM (odBC9)

2 >>>And is now in FBI custody.

A happy ending!

Posted by: m at October 21, 2026 04:02 AM (odBC9)

3 And why I mean that is someone figured out one of the keys they use to sign certificates.

The key was 4.

And that's close to the word for death in Cantonese, which is why they avoid the number 4, which takes us back to Kali, the goddess of death and destruction (AND rebirth)...

Posted by: jim (in Kalifornia) at October 21, 2026 04:07 AM (l3cgK)

4 G'Day everyone
Longer commute today

Posted by: Skip at October 21, 2026 04:07 AM (Ia/+0)

5 The plan is to return a sample of at least ten grams of Phobosian soil to Earth. The whole moon if they can capture it in the craft's Pokeball, but at least ten grams.

I chose YOU, Titan! Go fight Phobos!

Posted by: jim (in Kalifornia) at October 21, 2026 04:08 AM (l3cgK)

6 How to convert $1000 worth of laptop RAM to $1000 worth of desktop RAM.

Is this like the joke about how to make a small fortune in farming?

Posted by: jim (in Kalifornia) at October 21, 2026 04:09 AM (l3cgK)

7 A Canadian expert in ransomware negotiations who recently wrote a book recommending you should always talk to the people holding you to ransom was allegedly in cahoots with the ransomers. (Krebs on Security)

And is now in FBI custody.

Ah, he was doing an SPLC...

Posted by: jim (in Kalifornia) at October 21, 2026 04:10 AM (l3cgK)

8 Mornin'

Posted by: Puddleglum, cheer up for the worst is yet to come at October 21, 2026 04:12 AM (sAmhv)

9 The key was 4.

Not much brute at all in that force.

Posted by: SpeakingOf at October 21, 2026 04:14 AM (6ydKt)

10 The plan is to return a sample of at least ten grams of Phobosian soil to Earth. The whole moon if they can capture it in the craft's Pokeball, but at least ten grams.

Gotta catch 'em all!

Posted by: SpeakingOf at October 21, 2026 04:15 AM (6ydKt)

11 My installation of the Brave browser shows no eMudhra certificates installed in either the root store or the ones I've imported.

Whether they've been yanked or were just never there in the first place, I don't know.

4? Motherfucking 4?

Wow, I wonder how long it took to brute-force that one.

Posted by: Rodrigo Borgia at October 21, 2026 04:20 AM (qlLNh)

12 11 My installation of the Brave browser shows no eMudhra certificates installed in either the root store or the ones I've imported.

Whether they've been yanked or were just never there in the first place, I don't know.

4? Motherfucking 4?

Wow, I wonder how long it took to brute-force that one.

Posted by: Rodrigo Borgia at October 21, 2026 04:20 AM (qlLNh)

Depends where they started. LOL

Posted by: jim (in Kalifornia) at October 21, 2026 04:21 AM (l3cgK)

13 The top model costs $5900 and offers 256GB of storage. But that's a luxury item with a price to match; the entry level model with 64GB of storage - still quite a lot for MP3 files - is only $1900.

Wait.

wtf is Sony thinking with this.
You can pay much less, get a phone, text, and apps included, and pay over $1000 less for the same basic experience.

Good God, $1900.
My Sony Walkman's were espensive at the time, for sure.
I had a cassette version that was waterproof and was around $200 if I remember right.
The Sony CD Walkman I got next was cheaper.

Posted by: SpeakingOf at October 21, 2026 04:23 AM (6ydKt)

14 I have no idea what an SSL certificate is, which is a surprise to nobody here who knows what a non techy person I am ( and you all know that ) but your description of the Indian guy made me laugh. Are there stand up comedy routines for programmers and systems analysts, etc. if so, you should bring your show on that road, Pixy. Actually, I will show it to my husband . He used to be a technical person and he will laugh.

And thanks for the song from "America" I remember hearing them and I like it.

Posted by: FenelonSpoke at October 21, 2026 04:26 AM (JrHfD)

15 “Not a number that starts with 4, or the number 4 followed by a few hundred random digits, just, 4... Another one is 56, and another is 115. I know, because I recovered all of them from their public certificates on my laptop just now, and it took less than a second,” Helme wrote.

Other researchers have found private keys including the numbers 66, 155, 156, 230 and 237.

Those are vastly inadequate keys, because they’re easy to guess, making all certs issued by eMudhra susceptible to brute force attacks.

As Helme put it: “A P-384 private key should be a random 384-bit number, which gives you 2³⁸⁴ possibilities (or roughly 10¹¹⁵, so nobody is ever going to search that.”

lol

These Indians wanted easy to remember numbers for SSL certificates.

Posted by: SpeakingOf at October 21, 2026 04:30 AM (6ydKt)

16 Best America song is still A Horse With No Name.

I've enjoyed that song since the first time I heard it as a kid.

Posted by: SpeakingOf at October 21, 2026 04:32 AM (6ydKt)

17 Person writes on Exodus 14:15-30, and "The Riad to Fulfillment" despite roadblocks. Upper Room devotional:

https://tinyurl.com/34fju4a9

Posted by: FenelonSpoke at October 21, 2026 04:34 AM (JrHfD)

18 The key was 4.

youtu.be/-IOMNUayJjI

Posted by: Puddleglum, cheer up for the worst is yet to come at October 21, 2026 04:34 AM (sAmhv)

19 >>>The key was 4.

An essential key.

Posted by: m at October 21, 2026 04:37 AM (odBC9)

20 Story behind a great old hymn, "Abide with me and the hymn":

https://tinyurl.com/27fj2ptx

Posted by: FenelonSpoke at October 21, 2026 04:37 AM (JrHfD)

21 6 How to convert $1000 worth of laptop RAM to $1000 worth of desktop RAM.

Is this like the joke about how to make a small fortune in farming?
Posted by: jim (in Kalifornia) at October 21, 2026 04:09 AM (l3cgK)

Tell the joke! I don't know that one.

Posted by: m at October 21, 2026 04:37 AM (odBC9)

22 Sorry ; The quotes were just supposed to go around the title, not my additions.

Posted by: FenelonSpoke at October 21, 2026 04:38 AM (JrHfD)

23 Probably they did it on purpose, as a favor for some hackers or secret service.
At the same time, they have semi-plausible denial, so it will be hard to punish them (not sure anyone will try).

Posted by: PG at October 21, 2026 04:38 AM (1Xa6P)

24 "The key was 4."

Compromised during a game of golf?

Posted by: Grumpy and Recalcitrant, a Moron behind enemy lines at October 21, 2026 04:40 AM (O7YUW)

25 These Indians wanted easy to remember numbers for SSL certificates.

I would insult their intelligence, but they did it for me.

Posted by: Gmac-WTF did you think was going to happen at October 21, 2026 04:41 AM (Q/FnY)

26 Woman adopts gas station cashiers baby and they become like sisters. Sunny Skyz site :

https://tinyurl.com/2kej3sfr

Posted by: FenelonSpoke at October 21, 2026 04:41 AM (JrHfD)

27 How do you make a small fortune in farming?

Start with a large one.

Posted by: Additional Blond Agent at October 21, 2026 04:42 AM (iIyc0)

28 Thankfully, I doubt anybody outside India was getting their certs from these guys.

Posted by: SpeakingOf at October 21, 2026 04:46 AM (6ydKt)

29 > I have no idea what an SSL certificate is

On a really basic level:

Ever play around with newspaper cryptograms (like the letter 'a' becomes 'q', and the letter 'b' becomes 'k') and so on?

Same idea, except way harder to break than the newspaper ones (well, unless you use '4' as the key).

This keeps your neighbor on the same network from reading the data that flows between you and Amazon (or whatever).

Internet encryption is a special type called "public key" encryption. This uses some special mathematical magic that allows you make to the encryption key public without disclosing the decryption key. Newspaper cryptograms don't have that feature ... if you know that 'a' becomes 'q' when encrypted, you immediately know that 'q' will become 'a' when decrypted.

This has a big advantage. The remote site (say, Amazon) can encrypt special "I am Amazon" messages using the secret key, which anyone on the internet can then decrypt using the public key to verify that this is, in fact, the real Amazon.

Obviously this only works if the secret key remains secret.

(continued)

Posted by: Rodrigo Borgia at October 21, 2026 04:50 AM (qlLNh)

30 I am so grateful to God for the ladies who come to my Bible study at the senior care center . They are all in their 80's and have walkers or wheelchairs and they all trudge down the hall to a quiet place with a table, God bless them! . They have interesting questions and comments and I enjoy their company. Yesterday we started on "Revelation".

Posted by: FenelonSpoke at October 21, 2026 04:52 AM (JrHfD)

31 16 Best America song is still A Horse With No Name.

I've enjoyed that song since the first time I heard it as a kid.
Posted by: SpeakingOf at October 21, 2026 04:32 AM (6ydKt)

I like to think that the horse was actually named With No Name, and it's all been a big misunderstanding ever since.

Posted by: SciVo at October 21, 2026 04:54 AM (ke3zm)

32 27 How do you make a small fortune in farming?

Start with a large one.

Posted by: Additional Blond Agent at October 21, 2026 04:42 AM (iIyc0)

Yup. Late to the answer...was watching the railroad car implode...

Posted by: jim (in Kalifornia) at October 21, 2026 04:57 AM (l3cgK)

33 Gonna go to sleep...night.

Posted by: jim (in Kalifornia) at October 21, 2026 04:59 AM (l3cgK)

34 What's happened here, though, is even worse than that.

These key pairs are generated by so-called "certificate authorities" ("CAs"), such as this eMudhra outfit. Your browser has a list of CAs that it trusts, and will assume that any certificate signed by that CA is valid (the CA is supposed to take care of ensuring it's the real Amazon before issuing the certificate).

If the CA is compromised Bad Guys can generate fake keys (and thus, fake sites) that pretend to be Amazon, or your bank, or even AoSHQ and any browser that trusts that CA will take it as gospel.

If Amazon is run by idiots who leak their keys, Amazon is compromised. If a CA is run by idiots who leak their keys, *every company that uses that CA* and *every browser that trusts that CA* is compromised.

This is obviously Very Bad.

Posted by: Rodrigo Borgia at October 21, 2026 04:59 AM (qlLNh)

35 And yep, I'm out too.

I'm only up because my glucose alarm said I needed to get up and eat something.

Posted by: Rodrigo Borgia at October 21, 2026 05:02 AM (qlLNh)

36 Posted by: Rodrigo Borgia at October 21, 2026 05:02 AM (qlLNh)

Thanks very much, Rodrigo, for taking the time to explain all that to me. I really appreciate that .

Posted by: FenelonSpoke at October 21, 2026 05:04 AM (JrHfD)

37
Deep thoughts from an American self-imposed ex-pat:
I've never been to Spain, but I kind of like the music.
I really loathe the people though. Am I wrong to feel this?

Start with the word "feel" and work backward from there.

Posted by: Krebs v Carnot: Epic Battle of the Cycling Stars (TM) at October 21, 2026 05:07 AM (ixS3i)

38 The remote site (say, Amazon) can encrypt special "I am Amazon" messages using the secret key, which anyone on the internet can then decrypt using the public key to verify that this is, in fact, the real Amazon.

Rodrigo Borgia at October 21, 2026 04:50 AM

I'm going to go ahead and assume you intended the 'prime' pun in Amazon marketing AND asymmetric key generation.

Posted by: Nato at October 21, 2026 05:08 AM (mSbLJ)

39
g'mornin', 'rons

Posted by: AltonJackson at October 21, 2026 05:10 AM (AMvSw)

40
Woman adopts gas station cashiers baby and they become like sisters.

For a moment there -- just at the outset, mind you -- I thought that this might become a "never buy an egg salad sandwich from a gas station food dispensing machine" story.

Posted by: Krebs v Carnot: Epic Battle of the Cycling Stars (TM) at October 21, 2026 05:12 AM (ixS3i)

41 I like to think that the horse was actually named With No Name, and it's all been a big misunderstanding ever since.

Posted by: SciVo at October 21, 2026 04:54 AM (ke3zm)

It felt good to be out of the rain
In the desert, you can remember your name
'Cause there ain't no one for to give you no pain
La, la, la-la-la-la, la-la-la, la, la
La, la, la-la-la-la, la-la-la, la, la

Posted by: SpeakingOf at October 21, 2026 05:14 AM (6ydKt)

42
A phobophobosian is a person with an irrational fear of Mars' moob, Phobos.

You heard it here first.

Posted by: Krebs v Carnot: Epic Battle of the Cycling Stars (TM) at October 21, 2026 05:15 AM (ixS3i)

43
"moob", heh!

Posted by: Krebs v Carnot: Epic Battle of the Cycling Stars (TM) at October 21, 2026 05:16 AM (ixS3i)

44 Have a great day horde

Posted by: Skip at October 21, 2026 05:17 AM (Ia/+0)

45 "How do you make a small fortune in farming?

Start with a large one."

Oh, the Jeremy Clarkson method.

Posted by: no one of any consequence at October 21, 2026 05:19 AM (LOvBA)

46
I've been through the desert on a horse, with no name.

We really need to have a serious national conversation on riding horses anonymously

Posted by: Krebs v Carnot: Epic Battle of the Cycling Stars (TM) at October 21, 2026 05:21 AM (ixS3i)

47 Weinberg's Law:

"If builders built buildings the way programmers wrote programs, then the first woodpecker that came along would destroy civilization."

Posted by: Grumpy and Recalcitrant, a Moron behind enemy lines at October 21, 2026 05:21 AM (O7YUW)

48 Morning, Tech Peeps

Posted by: fluffy at October 21, 2026 05:23 AM (V0/Sp)

49 From the comments in article at The Register about eMudhra and the "4" key:

https://xkcd.com/221/

Posted by: Grumpy and Recalcitrant, a Moron behind enemy lines at October 21, 2026 05:24 AM (O7YUW)

50 The key was 4.

That’s dumber than the combination to my luggage!

Posted by: President Skroob at October 21, 2026 05:28 AM (NZIuw)

Processing 0.01, elapsed 0.0135 seconds.
14 queries taking 0.0052 seconds, 58 records returned.
Page size 45 kb.
Powered by Minx 0.8 beta.