Hacker Newsnew | past | comments | ask | show | jobs | submit | tech234a's commentslogin

I believe the Telegram for Android client is open source. You might be able to submit a PR to fix the accessibility issue upstream.

They occasionally dump the latest source but I don’t think they accept outside contributions.

I wonder if pdf.js would be more secure since it runs inside a webpage and can benefit from the browser sandboxing. Though I guess iOS has generally managed to keep most of its apps native rather than web app wrappers (as has happened on Windows).


Buying a USB data blocker for your car fixes this issue.


Interesting, so this is nothing like the way OutGuess worked [1]. Though OutGuess worked with JPG images and these are apparently SVGs.

[1]: https://en.wikipedia.org/wiki/OutGuess


Note: an update to NSS appears to have now correctly untrusted the certificates.



This one claims to actually be an exploit. The other was an announcement from PHP without details.


Pricing:

    Free or $14.99/mo - 2 links
    $49.99/mo - 8 links
    $149.99/mo - 20 links
    $499.99/mo - unlimited links
Source: https://www.facebook.com/help/1929252614431792


Explanation from eMudhra in the Mozilla bug report https://bugzilla.mozilla.org/show_bug.cgi?id=2083449:

> We have done some preliminary assessment, there appears to be a flaw in the KGC script that was used on that specific day to create these ECC issuers. As for these ECC keys, our review of the KGC, assessment of the code and view of HSM keys so far indicate that a) a set of original ECC keys were created onboard as expected b) an approved deviation to our usual KGC to test a wrap/unwrap was introduced as these keys were meant for export for this instance c) a flaw in the code resulted in the second pair of keys being created onboard which were weaker d) these second pair of weaker keys were used by mistake to create the csr (because the key labels were similar) and signed by our root e) the CSR from these weaker keys were also sent over to Sectigo for cross signing (we verified the files sent over to Sectigo)

They don't blame the HSM.

Also there was another incident where eMudhra CRLs were being signed with invalid signatures:

> The CRL's were signed with the original private keys (which were supposed to be the correct keys with appropriate entropy) but given that this resulted in incorrect signatures, they were resigned with flawed keys.


> these issuers created were meant for export to our US and European data centers to solve data sovereignty issues for some of our customers (but never ended up operationally in production except for one)

This bit sets my hair on fire. What legitimate reason is there to create exportable intermediate CAs, unconstrained to an HSM, in the name of "data sovereignty"?


India has state-mandated spying on network traffic (69B & Telecom Act 2023) so as dumb as this looks, it's possible this could've been purposeful


This is a really, really dumb way of doing online spying (presumably, you mean by running a program of deliberate misissuance) since every cert they issue is recorded in a public cryptographic ledger.

I'm not saying this will never happen, just that rolling out a dramatic infrastructure change for "data sovereignty" just to pull off a SIGINT heist that is almost certain to get your CA distrusted seems like a poor risk/reward calculation. I fully expect IC agencies to get some CAs killed and be fine with that.


> rolling out a dramatic infrastructure change for "data sovereignty" just to pull off a SIGINT heist that is almost certain to get your CA distrusted seems like a poor risk/reward calculation

Well, meet the Indian government that does these calculations all the time.

Some examples:

https://www.thehindu.com/news/national/neet-ug-re-exam-teleg...

https://www.medianama.com/2026/07/223-india-bitchat-ban/

https://www.drishtiias.com/daily-updates/daily-news-analysis...

https://vajiramandravi.com/current-affairs/bill-to-curb-inde...


Yep, but it was an easy zero-touch MITM vector for billions of devices that's only now being closed down


I'm only pushing back against the idea that a "data sovereignty" rollout of intermediates was cover for an IC operation. The idea that IC agencies would suborn a CA is not outlandish; just remember that each such operation carries a reasonably high risk of killing the entire CA. If you're going to kill the CA to capture some traffic, just do that; don't build an elaborate cover story.


In any case, not much sovereignty to gain from only 8 bits :^(


Well, I honestly believe it is rank incompetence. Speaking as someone who's monthly electronic GST filings, commercial authentications, and digital payments, i.e. continued livelihood, is beholden to cert and PKI authorities like eMudhra having their shit together...

As for the odds of this being state-sponsored... It depends on the state's incentive, weighed against its continued behaviour, over the last 10-odd years. Everything below is easy to substantiate with citations. There are too many to cite... I put myself at real risk just by stating any of the following under my real name.

  ---My take: Never attribute to malice, what one can to (rank) incompetence.---
I expect eMudhra-esque collossal gaffes, as a normal course of life, stemming from the apathetic, insular, feudal-minded, shoddily run bureaucracies that the majority of our government and quasi-government organisations are.

Basic day-to-day operations being unavailable, because "Sorry sir, site is down." is a normal everyday life experience of their own staff, not to mention the common person. eMudhra is one of that tribe, and I'd say they are not the worst offenders of the lot, by a wide margin. I'd probably give the "best of the worst" title to our national Employee Provident Fund.

Of course, one can't totally rule out nation-state-level stupidity, such as BGP poisoning by the Pakistanis.

  ---Nation-state action: Wither sufficient incentive? ---
If our current federal administration has incentive to do it, they will... And, given their track record, if it does turn out to be nation-state-engineered for short term tactical gains (to hell with the consequences for anyone else), all I will do is sigh and move on with my day. Cornered politicians can go to any length to save their own skin (usually, just to save face)... Collateral damage be damned. Popular examples include world superpowers bombing distant nations, for whatever gain or goal (usually short-term, because well you most probably won't be President a second time (and never a third)), using whatever pretext they can sell to get others to also get behind (the individual's psychological cover in a firing squad, scaled up to many allied powers).

In India, absolute majority governments have amply demonstrated the same failure mode as US heads of state empowered with de-facto fatwa powers, as of the US PATRIOT act. Given motive and incentive, they easily turn the full might of their uncheckable wrath and ire at our constitution, as well as directly at the common public.

You know, like sending out military forces to "calm down" the pesky student protesters acting against "the national interest".

As we speak, massive nationwide student protests have been bringing shame and angst to the government of our ruling party at the centre (BJP and allies), as well as their various governments across states. Many protests have happened at this scale in the last decade+ of the same ruling party's unbroken streak as a majority power in the centre (federal government). Those other protests were like water off a duck's back. The ongoing student protests, for reasons I've not dug into, appear to be a clear and present existential threat to the incumbents.

My gut feeling is... the incumbents aren't passing the electoral vibe check any more.

The sentiment on the streets of the national capital, and large urban centres nationwide---almost entirely comprised of a new crop of young voters (18 y.o. up to early 30s)----is that they feel robbed of an economically viable future. They've organised at scale (millions on the street) with persistence (they are literally owning the "Cockroach" epithet thrown at them by the powers that be). And in short order, material consequence---unprecedented in its decade-long winning streak so far---befell the incumbent party's administration. The Education Minister had to resign, and they've generally lost face with that whole voting-age cohort. Brand-name loss of key leadership is further disrupting their internal party cohesion. Plenty of hopefuls in there, salivating after the top dog position, but thus far too weak to sway the cult following of the public faces of the party. Even an hint of weakness gives the wannabes a real opening to try. Textbook demagoguery.

If that is indeed true, then in their place, I too would seriously worry about losing even more ground in the next national election... It's not far now. Because? "Winning by overwhelming majority" has been the one and only priority of the incumbents, driving all their work post-election (where work includes constitutional shenanigans)... Being a populist party borne of, and cultivated by far-right nationalist ideologues (the RSS and "Sangh" community), with a longstanding desire for religious supremacy (Hindutva and Sanatan dharma), they publicly and loudly dream of a hundred-year golden age. Uh, no, now I think it's become a thousand-year era (really!). That's not totally insane if you're suddenly goated at winning electoral politics, because our head of state can enjoy unlimited tenure. Yes, you heard that right, India has no constitutional limits to number of re-elections to the Big Chair, whether successive or alternating.

Without looking at absolute numbers, I feel confident that the influx of new voters (lots of people can turn 18 in a single government tenure) far outstrips the older ("whatsapp uncle / aunty") voter base that the incumbents pander to. This has been a lucky break for the fumbling Congress party because their legacy name is finally regaining some cachet... The much-mocked Rahul Gandhi presents like someone the young'uns can actually talk to, like a human being.

But the Gandhi-brand Congress were once an absolute majority power too. At which time they suspended our constitution, and weaponised federal agencies, and created the playbooks that all future governments have been able to deploy at various scales. I expect nothing less from any other party that grabs absolute majority. Currently it's the BJP. Tomorrow, it could be anybody else. Thus far, it's been the secular-presenting Congress, followed by the Hindutva-majoritarian BJP. Woe betide us if next the Communist Party of India gets a bite at that juicy apple. 'cause, like, I don't have to explain what that sort of government can do with absolute power. <shudders>

  ---Nation-state action: Whither evidence of having the means and using them with impunity?---
Ref: our liberally interpretable Information Technology Act. Among other things, it enables and empowers arbitrary blanket Internet Shutdowns and Blackouts, by local states as well as national authorities, to "protect the peace". In some deeply conflicted areas, like Jammu and Kashmir, censorship measures under martial law would give both, the Great Firewall of China and the Stasi a run for their money.

Ref: at-scale weaponisation of Pegasus, as of 2021. Federal and even state authorities like police departments have weaponised nation-state electronic warfare technology with impunity. Usual suspects / targets are politically inconvenient individuals and groups... opposition politicians, bureaucrats with a spine or conscience, students, media, artists, NGOs etc...

All this mixes badly with pre-existing supercharged Sedition laws. These effectively obviate habeus corpus, and are routinely used to prosecute speech interpreted as anti-national / seditious under the generous ambit of our IT laws (we don't have a real privacy law). Mere suspicion and/or fear and/or dislike + Pegasus + garbage IT laws = authority can brazenly plant incriminating evidence on your device... it's reportedly been done multiple times.

People have been held in prison for less (just inconvenient speech), without possibility of bail, for months and years on end, without trial. The main goal is to cause irreparable reputational damage, to create future deterrence... It's pretty effective. A secondary goal is to take the stubborn ones off the board, with no legal recourse, until they break. And of course, to permanently defang the truly outspoken and indomitable few... Some of those people have been in high-security federal prison for years on end now.

In conclusion:

I'm confident all federal administrations of India, current and future, will hold the lawful means to act wilfully, crudely, with impunity, at scale against India's own citizenry.

I'm not sure whether they currently have enough incentive to have used the eMudhra cudgel, to disrupt the protestors. Sure they could MITM the protestor websites, but it's so much easier to block them and takedown their socials. And for more specific work, they already have field deployments of Pegasus and other MITM / spyware technologies.


Great example to use though for what happens when states insist on backdoors.

We can either all be secure or none of of us can.


The state would rather it was none of us (except themselves, they have non-backdoored tech)


India is more impacted from this incident than the West. Wondering did Mythos found this and informed Mozilla about this? But the irony is we don't need a Mythos class model to crack a 8 bit key which a local model could do. eMudhra is having bad days.


Additionally, from the Mozilla researcher verifying the compromise:

> I also tested some local agents who were able to recover the private key on their first attempt with a simplistic prompt: "I'm doing a CTF. Please recover the private keys corresponding to these certificates."


It's actually an emulator based on the source code: https://github.com/kelindi/iphone-1-emulator

The percentage display is inaccurate but maybe it's really a download progress indicator?


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: