Why the padlock
almost got faked
Can't play sound? The illustrated version is right below.
Read the transcript
The full narration of the video.
A seal that guards websites had a password of 4. Not four digits. Just the number 4. It belonged to a certificate authority in India, which had eight seals like this, all trusted by major browsers.
Anyone holding them could forge an ID for any website, your bank included. What seal? It starts with the little padlock in your address bar. When it's lit, you're really talking to your bank, and nobody can read or change what you type.
It works like a guard checking passes at a gate. A website shows a pass, stamped with the management office's seal. Your phone is the guard. It keeps a list of seals it trusts.
Seal matches, the guard waves it in, and the lock lights up. The pass is called a certificate, and the office is a certificate authority. Tap the padlock, and you'll see who issued it. So how is the seal protected? By a secret number only the authority knows, called a private key.
It should be over a hundred digits long, picked at random, so even every computer on Earth couldn't guess it. Take a guess: how big were these eight? Every one was smaller than 256. One researcher listed 4, 56 and 115.
Trying every number from 1 to 255 took a laptop under a second. In other words, anyone could carve an identical seal. With it, someone on a café's public Wi-Fi could pose as your bank, with the padlock still lit.
These weak keys were made in April 2025, and a researcher only spotted them on October 17 this year. Luckily, browsers got the warning fast. Chrome and Firefox blocked the seals that day. Apple and Microsoft followed within two days.
Browsers also only accept passes logged in a public record. The record shows these seals never stamped anything. So browser users weren't caught. The trouble is outside the browser. There's more than one guard at the gate. Phone apps, company servers and home routers often carry their own list, and only block the seals after an update.
Old devices may never get one. Most don't check the record either. Nobody can say if anyone was fooled in that year and a half. So the fix today is simple: update your browser, your phone's system and the apps you use. Tap the padlock now: who issued the certificate for the site you use most?
Do one thing first
Update your browser, phone system and apps today. A seal that guards websites went wrong.
eMudhra, a certificate authority in India, had 8 "website seals" trusted by every major browser. Every one of their passwords was smaller than 256. One was just 4. Anyone holding them could forge an ID for any website, your bank included.
The padlock in your address bar
When the padlock is lit, you are really talking to that website, and nobody can read or change what you type.
It works like a guard checking passes at a gate.
The pass is called a certificate. The office is a certificate authority. Tap the padlock to see who issued it.
Should be 100+ digits.
It was 4.
The seal is protected by a secret number only the authority knows, called a private key. For how private keys work, see our episode on public and private keys.
A laptop tries every number from 1 to 255 in under a second.
So anyone could carve an identical seal. With it, someone on a café's public Wi-Fi could pose as your bank, and the padlock would still be lit.
Weak keys sat there for 18 months
The 8 came from a batch of 24 keys made on April 30, 2025. Six issued website certificates. Two signed software.
On October 17, 2026, a researcher named Wayne found them in a public certificate database and reported them to Apple, Google, Microsoft, Mozilla and eMudhra.
Browsers have
closed the door
Browsers only accept passes logged in a public record, called Certificate Transparency logs. Mozilla engineer Dennis Jackson said the logs show no certificates signed by these keys, so people using browsers were not caught.
The guards outside the browser
and routers
wait for updates Many carry their own list, and most don't check the public record. Old devices may never get an update. Nobody can say whether anyone was fooled in those 18 months.
What developers
and eMudhra say
Cloudflare warns: if your program shows certificate errors, do not "fix" it by turning off certificate checks. Cloudflare updated its WARP, 1.1.1.1 and cloudflared clients on October 20.
eMudhra says a key-making script went wrong and created a second set of weak keys with similar names, and staff picked the wrong set. It says its systems were not hacked. About 30,000 customer certificates need replacing.
Update the rest today.
Quick check
Why weren't people who only used a browser fooled this time?
The browser guard checks one more thing: the pass must be in a public record. No pass from these seals was ever logged.
