IndiaEight certificates had private keys just 3-8 bits long.
Anyone could forge trusted credentials for any website, until browsers blocked all eight on Tuesday.
The intermediates belong to India-based certificate authority eMudhra, and a message signed with one key proved the weakness.
Exploiting them needs an adversary-in-the-middle attack, and no transparency log shows malicious use yet.
Engineer Filippo Valsorda expects a cleanup bigger than Heartbleed, with Linux distributions and embedded devices lagging.
How each outlet framed it
- Ars Technica leans critical
- emphasizes that the compromised eMudhra keys could mint trusted credentials for any site, and that Linux distributions and IoT devices make the fix slow
Sources: Ars Technica