The emudhra certificate problem means that people can potentially man in the middle https. Make sure you update everything including apps like termux
To test if impacted visit or curl this site: https://dv-g3b-emudhra.we-have-a-problem.com/
You must log in or # to comment.
Apple was notified of the eMudhra incident on 17th October. As of 28th October, the developer tools Apple ships with macOS, including git, curl and python3, still trust the compromised certificates.
Lmao
Meanwhile on Debian, famous for using older packages:
$ git ls-remote https://git-emudhra.we-have-a-problem.com/check.git fatal: unable to access 'https://git-emudhra.we-have-a-problem.com/check.git/': server verification failed: certificate signer not trusted. (CAfile: /etc/ssl/certs/ca-certificates.crt CRLfile: none)Debian pushes out security updates within hours when it is severe. Older packages doesnt mean unsupported
If you use GrapheneOS, updating to 2026102100 (or higher) will take care of this for you.
remove the active eMudhra ECDSA root certificate due to compromised intermediate certificates (Vanadium received the removal of this root certificate as an out-of-band component update via our servers when it was released for Chrome)
remove both legacy eMudhra root certificates (this leaves the heavily used active RSA root certificate as the only remaining one and we’re considering either removing it or disabling it by default despite other platforms not removing it at this time)
Better: never trust https. It’s highly likely that at any point in time, at least one of your adversaries has control of a CA in your root store.
Use Tor Onion Services. It solves this issue by using pinned certs.
What’s the tor address for google?
There is no technology that exists that would keep the data you send to an evil US company safely private
check with this one and it will give you a proper checklist, fyi: https://emudhra.we-have-a-problem.com/
Updated my apps and now r/All doesn’t work on reddit. Thanks a lot.
that sounds amazing
I turned those off in the cert storage in settings. No need to wait or get caught by an edge case.
All major browsers have already updated to not trust their SSL certificate. It should show an error on all major browsers.
That only covers mainstream web browsers
Any apps that rely on https will be vulnerable
Apps using system webview are already mitigated. Apps using system HTTPS connection protocols and SSL libraries are also mitigated. Now, for some apps which ship and use their own SSL library and do not use google safe browsing or update the cert list online they could be vulnerable.
The vast majority of app network requests would be secured by getting the TrustStore patch via Play Services, with only exceptions shipping their own crypto stack needing to update to be secured.
Still, updating your apps regularly is good practice that you should follow anyway
Don’t forget custom roms
That’d hopefully be solved with an update to that ROM in that case.
I wonder if that would be with Googles now twice-yearly released security updates. That’s a long time between security updates.
like termux
Am I missing something or has termux not released an APK update since 2025? Or are you referring to
pkg upgrade?pkg upgrade probably
Got it, always good to keep that up to date.
Bold of you assume manufacturers are going to bother.
Some app devs probably will.
