• Trainguyrom@reddthat.comEnglish
    10·
    2 days ago

    Some number of years ago I worked in support for a mobile phone manufacturer. I spoke with one person who found themselves on the certificate section of Android and had disabled every non-american certificate then was shocked when their device basically stopped working…

  • Victor@lemmy.world
    111·
    2 days ago

    Thanks for the tip! I can’t imagine what the person was thinking who down voted this. Must have slipped on the wrong button.

    • AdrianTheFrog@lemmy.worldEnglish
      4·
      1 day ago

      pretty much anything that gets more than like 100 upvotes will have at least one downvote (including lemmy, reddit, youtube before they effectively got rid of dislikes, etc), I also don’t really know why but it’s basically universal

      • JackbyDev@programming.devEnglish
        5·
        2 days ago

        For the curious, down votes on stuff native to an instance that doesn’t have down votes just won’t federate the down votes. So essentially, any down votes anyone sees is from their own instance.

      • Victor@lemmy.world
        4·
        2 days ago

        5 down votes now, who in their right mind…

        But 500+ up votes and counting 😎 The haters are getting ratioed!

        Good post!

        • Melvin_Ferd@lemmy.world
          32·
          2 days ago

          Why the hell are you guys looking at voting. It’s a left over to placate users after they just went full overseer mode with our spaces. It’s a digital key chain they dangle. It doesn’t do anything

            • Melvin_Ferd@lemmy.world
              1·
              23 hours ago

              No it has practically no impact. Back in the day it would. But user control means users could control how a website works. It meant we could reject ads or posts that were secretly selling us things or just political message that users controlled. Reddit and the other sites removed what it was originally for and left its dead corpse for us to feel like we’re doing something.

              These spaces are all mods. Mods determine what we see. Lemmy decided to implement the same corporate control the reddit evolved into rather than the more liberal/leftist origins that made it popular at the start.

              Moderators are not normal people. They should have almost no say in anything. The only reason to give them so much control is if you’re trying to create propaganda machine. Mods should only be there to remove illegal content and maybe protect against a brigade. Users take care of the rest. It’s literally how many leftist want society to run. Yet for some reason we use this overseer type model where mods abuse power every day and we just ignore it like we’re a police department. It’s ok as long as it gets the job done right boys.

          • Victor@lemmy.world
            2·
            1 day ago

            It’s pretty obvious from the first comment, no? I was surprised to see anyone down voting this at all because it’s just plain, objectively sound advice.

            But in the end the ratio of up/down is still comforting and not so disappointing.

            Makes sense?

    • Wirlocke@lemmy.blahaj.zone
      10·
      1 day ago

      These certificate companies are responsible for keeping internet traffic encrypted.

      They use a private key which you can imagine as a combination number lock of 116 digits.

      This specific company seemed to only be generating numbers that fell in the range of 0 to 256, and at the time of the breach the smallest one was 4.

      I want you to imagine your data being secured with a lock using a numpad of 116 digits. Now imagine the passcode turned out to be 115 zeros and then 4.

    • homosapien@lemmy.dbzer0.comEnglish
      4·
      2 days ago

      emudhras certifications got pwned so anyone can pretend to be anything with an emudhra certificate. Android lets you stop using certain certificates

    • GreenKnight23@lemmy.world
      4·
      21 hours ago
      1. certificates encrypt web traffic
      2. companies exist to create world trusted certs
      3. these certs are signed by their private key with a random hash generated that’s globally unique
      4. is not random enough

      edit: I love that there’s only 4 upvotes on this. 🤣

  • SteveTech@aussie.zone
    64·
    3 days ago

    FYI, G3 is the only one listed with the issue, the others are fine AFAIK. But if you don’t trust eMudhra at all after that, then that’s fair.

    Edit: Actually it’s the intermediate certs that are compromised, the roots are still fine, but many of them come from the G3 root cert (and Sectigo’s AAA Certificate Services)

    Source: https://emudhra.we-have-a-problem.com/

      • SteveTech@aussie.zone
        22·
        3 days ago

        Yeah, my understanding was they’re not issuing new certificates, but the current ones are still valid until they’ve expired.

        • slazer2au@lemmy.worldEnglish
          111·
          3 days ago

          Recently learned that root CA don’t actually expire. Yes, they have an expiration date, but nothing pays attention to it for a CA.

          • Bazoogle@lemmy.world
            2·
            23 hours ago

            It depends on the OS. Some do start to warn you about invalid certs for all certs signed by the root CA, but you can often click continue anyway.

          • SteveTech@aussie.zone
            16·
            3 days ago

            Well you can’t sign new certs (with the current date) with an expired root/intermediate cert, but the root/intermediate cert expiring doesn’t strictly invalidate the already signed certs.

            But I was more talking about the end-user certificates in the previous comment.

        • redjard@reddthat.com
          4·
          2 days ago

          It appears so, inside India anyway.
          I saw some of the compromised certs were code signing ones, but it seems the “DSC” certificate infrastructure they advertise for documents is something else entirely (“issued under the Government of India guidelines”).

          The kind of cert that lets you sign a pdf and have everyone see it pop up in adobe reader won’t be a thing anymore since they’ll end their CA activities. (Chrome already removed their root cert, many other places will have done the same. Who wants certs that don’t work everywhere?)

          Also, given the state of emudhras online presence I saw when I just looked all that up, I’m not convinced the company will be around much longer either. One of the first domains I landed on had a cert that expired in August. Another domain is completely dead.

    • who@feddit.orgEnglish
      3·
      3 days ago

      Excerpt from that page, for Android:

      • eMudhra Technologies Limited: emSign ECC Root CA - G3
      • Comodo CA Limited: AAA Certificate Services

      Of course, people using an Android variant that still gets regular updates are unlikely to need manual disables, since an update will take care of it.

  • meejle@piefed.worldEnglish
    39·
    3 days ago

    If anyone else here uses AdGuard, the latest version of their app rejects the affected certificates. 👍

  • Buddahriffic@lemmy.world
    3·
    2 days ago

    Only had one on my device, but I disabled it. Even if this one isn’t openly compromised like the others, it was a big sign that the company is either incompetent or corrupt (or both).

  • state_electrician@discuss.tchncs.de
    471·
    3 days ago

    I once tried to disable all but the ones I actually need. There are close to 200 CAs trusted by my devices and I only need to trust about 15 of them. But it’s a colossal pain in the ass to figure out which CA an app needs, so I abandoned that experiment.

    • printf("%s", name);@piefed.blahaj.zoneOPEnglish
      16·
      3 days ago

      Yeah, I too had that ambition once, but I didn’t even know where to begin, since I don’t know how to find out which once my apps, websites and other services actually need. Other than investigating whole chains of collaboration between the various owners and devs of those services. Arduous much? 😅

      • state_electrician@discuss.tchncs.de
        8·
        3 days ago

        I used a proxy to look up which servers the app was trying to talk to, looked up the cert from the server and which CA I needed. It was very arduous, especially when you installed a new app and just wanted to use it, e.g. for parking. This made me stop doing this. When giving talks to junior devs I used to explain that security and convenience are almost always on opposite sites and you need to figure out where between the two extremes you want to sit. In this case I opted for convenience.

    • printf("%s", name);@piefed.blahaj.zoneOPEnglish
      16·
      3 days ago

      No problem! But as I told another person, I’m only doing this because I’m not updating my phone anymore, because One UI 8 and above have disabled unlocking of the bootloader. If you’re not rooted and you are still receiving updates from the vendor and Google, then I can’t imagine this being useful.