A certificate authority issued intermediate TLS keys with so little randomness that researchers could recreate them, putting browser trust, certificate revocation, and the systems beyond the browser under a harsh spotlight.
Tom Eston, Scott Wright, and Kevin Tackett explain the certificate chain in plain English, why a public key is meant to be shared while a private key must stay unpredictable, and why organizations need to account for trust stores in browsers, Java, appliances, containers, and embedded systems.
Special thanks to Guardsquare for sponsoring this episode! Guardsquare is the leader in mobile application security, with multi-layered protection for your Android and iOS apps. Learn more at Guardsquare.com.
** Links mentioned on the show **
CyberScoop — eMudhra kills its certificate business after researchers cracked its private keys in under a second
https://cyberscoop.com/emudhra-shuts-down-certificate-business-weak-private-keys/
PCWorld — Microsoft pulls 7 eMudhra certificates from Windows. Here’s what that means
https://www.pcworld.com/article/3270717/microsoft-pulls-7-emudhra-certificates-from-windows-heres-what-that-means.html
Computerworld — eMudhra quits global TLS certificate market after compromise of CA signing keys
https://www.computerworld.com/article/4239619/emudhra-quits-global-tls-certificate-market-after-compromise-of-ca-signing-keys.html
Free Press Journal — eMudhra apologises after weak keys expose eight certificate authorities
https://www.freepressjournal.in/tech/emudhra-apologises-after-weak-keys-expose-eight-certificate-authorities-exits-global-ssltls-business
Purchase Scott Wright’s new book “The Digital Legacy Tree: Ensuring your loved ones can access the important parts of your digital life when it matters most”
https://www.amazon.ca/Digital-Legacy-Tree-Ensuring-important-ebook/dp/B0HN6B8Z7F
** Watch this episode on YouTube **
** Become a Shared Security Supporter **
Get exclusive access to bonus episodes, listen to new episodes before they are released, receive a monthly shout-out on the show, and get a discount code for 15% off merch at the Shared Security store. Become a supporter today by going to our YouTube channel’s membership section: https://www.youtube.com/channel/UCg9CCDIYkDDqwEZ3UYaxjnA/join
** Thank you to our sponsors! **
SLNT
Visit https://www.slnt.com/sharedsec to receive 10% off SLNT’s amazing line of Faraday bags and other products built to protect your privacy.
** Subscribe and follow the podcast **
Subscribe on YouTube: https://www.youtube.com/c/SharedSecurityPodcast
Follow us on Bluesky: https://bsky.app/profile/sharedsecurity.bsky.social
Follow us on Mastodon: https://infosec.exchange/@sharedsecurity
Join us on Reddit: https://www.reddit.com/r/SharedSecurityShow/
Visit our website: https://sharedsecurity.net
Subscribe on your favorite podcast app: https://sharedsecurity.net/subscribe
Sign-up for our email newsletter to receive updates about the podcast, contest announcements, and special offers from our sponsors: https://shared-security.beehiiv.com/subscribe
Leave us a rating and review: https://ratethispodcast.com/sharedsecurity
Contact us: https://sharedsecurity.net/contact
