Compromised Certificates

I’ve briefly seen the news regarding compromised intermediate certificates from some unknown CA (eMudrah) yesterday, but quickly dismissed them. I was like, shit happens, something leaked, certificates were already revoked, I was not affected, all good. Well, it appears the problem was much bigger. After a security researcher posted private keys for all certificates on GitHub (note the repository name), it has become clear that they weren’t private at all. Instead of 384 bits long random numbers, astonishingly, they were literally 4, 56, 66, 115, 155, 156, 230, 237. And while you’re trying to comprehend this, an obligatory reminder of this timeless XKCD comic. © XKCDHow could this even be possible? The most plausible explanation is that these keys originated from some test environment, which was accidentally pushed to production. Anyway, I’d call it the biggest security issue ever. Internet and computers in general run on trust. You as a user trust developers of the operating system…