A researcher reported on October 17, 2026, that eight eMudhra subordinate certificate authority key pairs had been generated with almost no entropy, making their private keys easy to recover. Chrome responded by blocking the affected TLS intermediate keys and removing the emSign ECC Root CA - G3 from its root store. It continued reviewing a second eMudhra root, emSign Root CA - G1. Although eMudhra said it would leave the global SSL/TLS certificate business and move customers to other providers, it did not provide satisfactory answers about its key-generation and management practices. The Chrome Root Program says it therefore cannot establish that the known weak keys are the full extent of the risk.
Chrome plans to stop trusting TLS server certificates that chain to emSign Root CA - G1 if their earliest Signed Certificate Timestamp is later than November 16, 2026, at 11:59:59 p.m. UTC. Certificates with an earliest timestamp at or before that cutoff will remain unaffected. The restriction is intended to take effect in Chrome 153 and later, with timing aimed at the Chrome 158 Stable release on November 17. Users or enterprises that explicitly trust the root through their platform settings can override the restriction. The schedule may change if new information emerges; further compliance failures or risks could lead to faster action, including blocking issuing CAs or removing the root entirely.
Summary generated by AI from the linked article. hn.today is not affiliated with Hacker News or Y Combinator.
Brazil’s Credit Guarantee Fund (FGC) reported unauthorized access to personal data in systems used for guarantee payments, but has found no evidence of disclosure, misuse, or financial loss. It restricted access, blocked unauthorized accounts, notified Brazil’s data protection authority, and continues investigating the incident. (fgc.org.br)
Data collected through ads in popular apps gives police a way to track users’ phones. The surveillance relies on advertising technology rather than direct access to a device. (bloomberg.com)
Mark Cuban says Facebook knowingly runs scam ads featuring AI-generated deepfakes. Documents reportedly estimate the platform earns $16 billion from fraudulent ads. (finance.yahoo.com)
Claude Code allegedly sends users’ email addresses to third-party websites in the User-Agent header during web searches. The reported privacy issue prompted a request to remove the behavior entirely. (github.com)
CVE-2026-83844 is listed as a remote code execution vulnerability in MS Paint. The provided page contains no details about affected versions, exploit conditions, or fixes. (cve.org)
A remote code execution vulnerability affects Microsoft Paint. An attacker can exploit it by getting a user to open a specially crafted file in the app. (msrc.microsoft.com)
Today's best Hacker News stories, summarized and screenshotted, one email a day.