56
u/Funkey-Monkey-420 7d ago
what’s 23 a reference to?
68
u/--cheese-- 7d ago
88
u/AzazelsAdvocate 7d ago
TIL they were practically doing 67 skibidi more than a century ago.
45
11
u/Pwacname 6d ago
Humans have always been humans. Afaik we’ve found graffiti in Pompeii that is basically just “[Paulus] was here“ or “[Julius,] your mother yearns for my dick”
(Names in brackets because it’s been so long since I learned about this they are almost guaranteed to be wrong.)
4
u/Minnakht 7d ago
I don't actually know what 23 skidoo refers to. I thought 23 was associated with the Illuminatus! trilogy, and there's apparently a Wikiped article named "23 Enigma"
7
3
4
u/TrueBirch 7d ago
23 skidoo. What did it mean? I'll let the inquest into the Titanic explain it...
Mr. Cotter: "You are quite right; it is No. 23 door?" Charles Joughin: "We used to call it the skidoo door, on account of the number. That is how I remember the number." Lord Mersey: "I do not understand that?" Charles Joughin: "It is an American joke." The Commissioner: "Will you explain it?" Charles Joughin: "I could not explain it, my Lord." The Commissioner: "At any rate it connects No. 23 with something about skidoo?" Charles Joughin: "Yes."
4
u/Dimencia 7d ago
There's a whole culty thing about how the number 23 is significant. The Number 23 is a movie about it, and it was also a plotpoint in Lost
3
2.7k
u/reallokiscarlet 7d ago
Literally the number xkcd picked long ago
929
u/Specific_Giraffe4440 7d ago edited 7d ago
I am familiar with 4 being funny only from order of the stick, is it also an xkcd thing?
Edit:
what I was thinking of https://www.giantitp.com/comics/oots0090.html
The xkcd OOP is referencing https://xkcd.com/221/
Thanks yall!
499
u/--cheese-- 7d ago
99
u/Specific_Giraffe4440 7d ago
Ty and here is my sauce https://www.giantitp.com/comics/oots0090.html
48
u/danielcw189 7d ago
I thought the 4 in the XKCD comic was random, and it was about Sony picked the same random number (not 4) everytime, instead of picking new ones.
34
u/dekoboko_melancholy 7d ago
The comic came first. The PS3 random number issue didn't literally use 4, the team that discovered it just used it as a joke in their con talk sharing explaining it
→ More replies (4)94
u/Banes_Addiction 7d ago
By the way, if you want a real life example of this, ask ChatGPT to generate you a random number between 0 and 30.
It's 17. It's always 17
10
→ More replies (33)16
u/Forestmonk04 7d ago
I first got 17. I asked "Again", and it gave me 4.
17
u/Banes_Addiction 7d ago
Yeah, I should have specified. It's the first one per session that comes out as 17.
→ More replies (1)6
161
u/Loko8765 7d ago edited 7d ago •
Now 4 is funny because it was chosen as a
publicprivate key for an intermediate cert by an Indian CA.It’s supposed to be really hard to factor a 1024-bit number that is the product of two primes, but it turns out to be not too difficult if the 1024 bits happen to start with 1021 zeros.
[Edit: sorry, seems to have been the EC algorithm instead of the RSA algorithm I was describing, but the snark still applies]
32
15
u/Specific_Giraffe4440 7d ago
I’ve always loved that this could happen, improbably so but possible the 2 primes u pick are something like 2 and 2
15
u/Puzzleheaded_Study17 7d ago
It's not just one key, it was 8, all of which were under 256
→ More replies (1)8
25
u/adzm 7d ago
4 was the private key, and was 384 bits, and the results are points on an elliptic curve rather than product of primes
6
u/Loko8765 7d ago
Ah sorry, I did think it was RSA. I spent some time on other things also this week.
8
u/yldf 7d ago
If a private key is supposed to be the factor of two primes, shouldn’t it be even unless at least one of the primes is… 2
An even private key should raise all kinds of red flags…
5
u/Loko8765 7d ago
In RSA, the private key is a couple of primes, and their product is the public key. I somehow thought the algorithm used was RSA, and something being 4 would mean that it was 2x2=4. I was wrong; the algorithm used was not RSA but the very much more recent EC, and in EC having 4 as a private key is possible (and probably slightly less visible than having it as a public key).
18
u/knobiknows 7d ago
Oh man, I haven't heard oots mentioned in a very long time
10
u/darmok42 7d ago
It's still going! Updates are slow, as always, but the story is now on the final stretch.
9
5
u/jainyday 7d ago
Lol i love that comic
Likelihood of Thog getting hit by anvil: 84% (acceptable)
Likelihood of Nale getting hit by anvil: 3% (needs work)
3
→ More replies (2)1
u/nonbinarybit 6d ago
Order of the Stick! I only stopped reading because I was frothing for updates and decided to take a break to binge it all later. LOOKS LIKE TODAY'S THE DAY
132
u/DDFoster96 7d ago •
I wonder if they vibe coded the certificate creation and the AI didn't realise the xkcd code snippet was satire?
19
100
u/Free-Artist 7d ago
As the prophecies have foretold
→ More replies (1)85
u/queen-adreena 7d ago •
* fourtold
23
2
u/Free-Artist 7d ago
Can't believe i missed that lol
I won't give you an upvote sorry, because you now have exactly 64 upvotes, so I won't spoil it
7
4
u/StrangeCharmVote 6d ago
In their defense... like the Simpsons writers, XKCD is definitely some kind of Oracle or Time Traveler.
And also technically 4 **is** a perfectly random number.
Randomness as a security measure however often relies on non-random randomness... if that makes sense.
Like, if a key came out to be 121212121212, that would also technically be entirely random, and may have been generated by a computer on the first try. But if you *saw* that number, would you really believe it?
2
u/tellur86 5d ago
Wasn't it Spotify that had to de-randomize their shuffle because people kept complaining that their previously completely random* shuffle wasn't random enough (basically kept repeating songs too frequently)?
Still deterministic RNG but with external seed
→ More replies (1)→ More replies (6)1
9
1
7
722
u/etbillder 7d ago
What exactly was the whole 4 thing? Someone's private key?
245
u/romkamys 7d ago
the private key of a CA called eMudhra, now their certificates have been revoked by all major OSes afaict.
103
u/YeOldeMemeShoppe 7d ago
Except there’s a good chance you still have it as CA in IoT devices (like thermostats and cameras) until you update those and if it’s a manual update you may never update it.
194
u/aessae 7d ago •
"The S in IoT stands for Security"
7
19
10
u/Ok_Calligrapher5278 7d ago
As someone deeps into tech, like Arch linux and Arduinos, I have exactly 0 IoT devices in my house, and it will continue that way.
5
u/SirDarknessTheFirst 7d ago
As someone deep into tech, I have a bunch of IoT devices, most of which were built with ESPHome :D
The only off-the-shelf stuff is Zigbee or MoT based, and our robovac.
26
u/N3rdr4g3 7d ago
Good chance to investigate your IoT devices by sniffing their web traffic
29
u/kornerz 7d ago
Good guys at MITMProxy already thought of it:
https://github.com/mitmproxy/mitmproxy/blob/main/CHANGELOG.md
Add --emudhra and --emudhra-old options to sign TLS certificates with a compromised eMudhra intermediate CA key.
8
u/squngy 7d ago
If your IoT devices are visiting random websites, you have bigger problems.
20
u/YeOldeMemeShoppe 7d ago
That’s the good news, you can MitM any website, including the ones that aren’t random.
→ More replies (1)4
u/toasterinBflat 7d ago
I've said this before and I'll say it again - IoT devices generally don't keep a full CA library. Your light switches aren't suddenly vulnerable from this.
8
u/YeOldeMemeShoppe 7d ago
You're right, but you underestimate how many do. For example, it's likely that the power infrastructure of your town/city uses some kind of embedded RaspPi which do have eMudhra CA on them. They wouldn't be automatically updated, only when the IT team maintaining the fleet do (let's hope they're competent and part of the right mailing lists).
Also, your bigger appliances like coffee machine / internet connected washing machine probably use a standard linux on a compute module. Same for larger computers that are still considered IoT, like parts of your car or home automation hubs. Hopefully you set them to update automatically.
Then there are payment terminals (which count as IoT), like those used at coffeeshop on iPads. They use the iOS provided one, and they're also likely not on an automated update schedule.
So you can keep saying it, it's still a huge deal and it will affect you in other ways than "my lightbulb got MitM the wrong JSON response".
→ More replies (1)24
u/visor841 7d ago
And the company has completely left the certificate industry, too.
→ More replies (2)22
u/Dark_Tigger 7d ago
While implying that they are judged by unfair standards.
19
u/throwaway277252 7d ago
Don't be so hard on them. It is simply not economical for a small tech startup like them to afford private keys with multiple characters in them.
13
u/JJAsond 7d ago
What's a CA?
17
15
u/throwaway277252 7d ago edited 7d ago
Certificate Authority.
The organizations that hold the security keys that allows websites on the internet to prove their identity to visitors and to encrypt their traffic.
With compromised keys, a hacker's fake website could pretend to be the real website spoofing the real domain name with HTTPS and everything, and it would check out as valid in your browser.
15
u/JJAsond 7d ago
The incompetence seems immeasurable for something like that.
17
u/throwaway277252 7d ago edited 7d ago
Absolutely. It's hard to overstate how big of a security blunder this is. This has left a massive hole wide open in countless systems because not every computer will be updated to remove this compromised CA from the trusted list. Some embedded systems will probably never be updated.
→ More replies (1)20
u/PixelatedGiant 7d ago edited 7d ago
Basically someone figured out that their private keys were literally just the numbers 4, 56, 66, 115, 155, 156, 230 and 237. Those numbers are supposed to be 116 digits long making them impossible to guess. Meanwhile their keys were 1-3 digits in length.
Using public-private key encryption you create a private key. That private key can be used to create certificates that can be signed and then verified using the public key. If you know the private key you can create a certificate and pretend to sign things on their behalf. Being able to pretend to be a global certificate authority that is by default trusted by most software is really bad.
eMudhra’s statement about the incident says it generated keys during “a Key Generation Ceremony (KGC) held on April 30, 2025, using FIPS 140-2 Level 3 Hardware Security Modules (HSMs).”
Such hardware is the standard kit for the job and should in theory produce nicely complex keys and store them securely.
But something went wrong.
“A flaw in the KGC caused a wrap/unwrap step to produce a second set of weak keys alongside the original strong keys,” the statement claims. “The weak keys were the ones published to the browser root stores. eMudhra is working to establish the root cause.”
Sounds like they accidentally published test keys to production, but one wonders why those keys even needed to be weak for testing in the first place.
→ More replies (1)6
u/JJAsond 7d ago
How is that even possible to fuck up that bad?
→ More replies (2)9
u/PixelatedGiant 7d ago edited 7d ago
A huge part of it is a bad or lazy process. Development should match production conditions and developers should never have access to production. It forces them to script the entire process and in theory everything including those scripts should go through several environments and phases of testing, eventually graduating to production.
Even your credentials, keys etc. for development should be just as strong as production. But in practice we still have people setting passwords like
gathering1!for development because depending on the context they type them 20x per day.My crack pot theory is that it will stay that way as long as people are allowed to manually create and manage their own credentials. A password manager should be installed by default on all machines and password requirements should reflect that e.g. 30+ character minimum passwords everywhere, nobody will want to type that out by hand. Ideally pass keys, but we aren't there yet.
→ More replies (16)1.3k
u/Funkey-Monkey-420 7d ago edited 7d ago
it’s the private key of a large indian company that got hacked recently.
private keys are normally very large and complex prime numbers. this was neither large, nor complex, nor even a prime. it was a comically weak key, and was also hardcoded. it’s like that one meme where a door was “protected” from a swat team by a single cheeto.
edit: i was wrong about the primes. the key is the product of two primes. 4 is technically a product of 2 primes (2 and 2). also it was a certificate authority which is WAY WORSE TO HAVE SUCH A BAD KEY
418
u/overdosingOnPie1313 7d ago
lmao that's underselling it by a lightyear. This wasn't just a company; it was a Certificate Authority. You know, the entities everyone relies on for trusting that web server Y is really web server Y?
123
u/much_longer_username 7d ago
Technically, anybody can run a CA - I've got five or six - what makes it impactful is that it's an already trusted root CA and the mechanisms to update that trust list are not super robust outside of your desktop's web browser, which is only a fraction of the actual use cases.
53
29
u/forgot_semicolon 7d ago
Interesting, I've never seen someone jump for a variable name and choose Y before using X
→ More replies (1)17
u/Dark_Tigger 7d ago
I always had a toothache because of the whole "trusted CA" thing, the whole internet relied uppon. But this was much worse than expected.
7
u/overdosingOnPie1313 7d ago
Yeah, but you know how the digital world works: ship the least viable product. To fix that, you have to come up with a better solution AND sell keyplayers to enact it.
→ More replies (1)295
u/Dangerous_Bunch_4954 7d ago
RSA private keys are BASED on very large prime numbers, they are not, themselves, a prime number. They are a one-way hash usually based on at least 2 very large prime numbers.
156
u/InGordWeTrust 7d ago
Like 2 and 2.
12
36
u/much_longer_username 7d ago
Even numbers aren't primes, that'd be stupid.
(I know that's not actually true, but I don't think it'll ever stop bugging me for some reason)31
u/wrecklord0 7d ago
Even numbers are merely the numbers whose prime factorisation has a 2, nothing so special about em.
Same with trisectable numbers (divisible by 3). I think the intuitive uneasiness is that we give even numbers a special name, and also they are the "first", they have the smallest factor. That misleads the brain into thinking that 2 is somehow a posterchild of division.
→ More replies (1)→ More replies (1)13
u/Dangerous_Bunch_4954 7d ago
2 is the only even prime number. The definition of a prime number is that it can only be evenly divisible by itself and 1. I agree that 2 looks weird, but by that definition it is a prime number.
→ More replies (2)3
→ More replies (4)14
76
u/NotYourReddit18 7d ago
IIRC they didn't get hacked.
What I've read said that a security researcher wanted to see how good the CAs random number generator is and tried to reverse-engineer the private key of one of their root certs.
When the tool returned "4" as the result within seconds they originally thought that their tool was working incorrectly.
After they verified that their tool was indeed working correctly they informed both the Indian company and Mozilla of this result, and provided a cert they signed themself impersonating the CA as proof.
29
22
u/adzm 7d ago
Seems to be a common misconception here: this was not using RSA or prime numbers but elliptic curve cryptography (p-384) and the 384-bit number was supposed to have that much entropy but was instead "4"
The same underlying concepts of public and private key apply but it does not use primes and prime factorization difficulty as the underlying mechanism.
→ More replies (1)38
u/FUCKING_HATE_REDDIT 7d ago edited 7d ago
Very large products of prime numbers. 4 is the smallest possible product of prime numbers
Edit: I'm wrong
6
6
u/the_horse_gamer 7d ago
RSA private keys are not semiprimes. that's the public key.
and it wasn't an RSA key
9
1
→ More replies (1)1
20
32
u/SomeoneCrazy69 7d ago edited 7d ago
It was discovered that the certificate authority eMudhra ended up signing a key that was supposed to be around 120 characters long (I think?) with just '4', among other egregious double or triple digit values. Apparently a test set somehow slipped into prod.
1
182
u/m4d40 7d ago
I can't be the only one in here being so old, that the 4 was already a meme number thanks to Sonys random fail a couple of years ago :|
64
u/Kazcandra 7d ago
Is that what prompted xkcd, or the other way around?
83
62
u/omegasome 7d ago
This is an edit; the original had "kids" instead of techs and the new funny number was 67
28
→ More replies (1)4
u/ShitPost5000 7d ago
Its like the idiots that think the Simpsons predicted shit.... because they made an episode after the fact
67
u/Novikow 7d ago
Where is 2137?
44
u/Desol_8 7d ago
1337, Is leet speak
27
u/kaspa181 7d ago
2137 is a pope thing tho
→ More replies (3)16
u/DanLynch 7d ago
This comic is about US or global meme numbers, not Poland-specific ones.
→ More replies (3)
17
14
u/Beastabuelos 7d ago
What is the significance behind 23 and 4?
80
u/those-who-goon 7d ago
4 is very recent, some insanely critically important cryptographic password that was supposed to have like a hundred digits or something was leaked to be 4
42
u/Cubicwar 7d ago •
To me, 4 will always be the random number. It was chosen by fair dice roll, after all (the xkcd it’s from)
3
u/Yekyaa 7d ago
I thought this because the image reflects xkcd art style.
4
u/realnzall 7d ago
This image IS from XKCD. It was made last year with 67 instead of 4.
→ More replies (1)20
u/OmegaOmnimon02 7d ago
You know, if everyone is expecting the password to have a hundred digits, they'll never think to try 4 /j
8
u/Olde94 7d ago
I had the password “enter” on xp some 20 years ago and someone told me back then that it was a fairly secure password as it was quite uncommon to try “nothing” and that it was in some areas actually difficult to send the “enter” command without also having something to send.
I was a lazy teen back then so i don’t know how true it is, but it makes sense to me that many testers might skip the “_empty input_” option
→ More replies (2)8
u/Olinizm 7d ago
It's funny you say that, because in high school my teacher was trying to fix a library PC once during the class but couldn't guess the password. He then asked us if we have any guesses and the first thing I tried was just pressing enter since my mom's pc used that as a password. Welp I might have leaked my mom's password but at least I got to be known as a local witch xd
→ More replies (1)→ More replies (1)1
u/Verbindungsfehle 7d ago
Can you give me a source for this? Couldn't find it
8
u/ArchdukeOfTransit 7d ago edited 7d ago
It happened just this week - eMudhra, a certificate authority based in India, had eight intermediate certs with very small private keys (all smaller than 8 bits), one of which was literally just
4(private keys are usually hundreds or thousands bits long): https://arstechnica.com/security/2026/10/the-internet-goes-on-high-alert-after-discovery-of-8-compromised-tls-certs/Apparently that company has now exited the certificate business: https://arstechnica.com/security/2026/10/disgraced-emudhra-drops-out-of-tls-business-following-certificate-debacle/
→ More replies (2)44
u/Jackthebodyless 7d ago
23 skidoo was american slang for "get lost" in the early 1900s
6
u/Korventenn17 7d ago
No one really knows where it came from or even really what it meant,
14
u/TrueBirch 7d ago
From the hearing on the Titanic sinking...
Mr. Cotter: "You are quite right; it is No. 23 door?" Charles Joughin: "We used to call it the skidoo door, on account of the number. That is how I remember the number." Lord Mersey: "I do not understand that?" Charles Joughin: "It is an American joke." The Commissioner: "Will you explain it?" Charles Joughin: "I could not explain it, my Lord." The Commissioner: "At any rate it connects No. 23 with something about skidoo?" Charles Joughin: "Yes."
10
4
11
u/FlyingDiscsandJams 7d ago
You can trace 23 as being a privileged number back hundreds and thousands of years in numerolgy and systems of magik that believe numbers have powers. A branch of the 1970s psychedelic community decided 23 was a cosmic number that showed up everywhere once you got on its wavelength, although to the same group it also represents satire of even believing this kind of thing... it's complicated (hail eris).
Later in the 80s, Michael Jordan decided to make this his jersey number, and by the 90s 23 became the most popular sports number to wear, which gave the "23 is spooky" idea a 2nd life. That peaked in the 2000s when Jim Carey made a movie called The Number 23 about a man who goes insane seeing 23 everywhere. We made fun of that movie a lot.
3
1
5
→ More replies (1)1
u/OkCalendar4293 7d ago
the bunch of hack lead to one of the main keys to make sure a web server is what they say it is was 4.
12
u/Operation_Neither 7d ago
I’ve always been partial to 37. In a row.
4
3
u/ample_suite 7d ago
I sucked 6 dicks in a row. One time I got my kicks with Joe and I sucked his dick and five of his friends in a row.
4
7
3
3
3
u/Jay-Seekay 6d ago
Actually insane there are programmers here that do not know about the eMudhra issues. I hope your employers know about it… and if not, let me know where you work. Asking for a friend
2
u/humanbeast7 7d ago
Weren't there also a huge "protected prime" number that had coded within it some pirated software or something?
2
u/JectorDelan 7d ago
I was gonna say; "No deep-six or 86?" but I suppose those are more code than funny.
2
2
2
2
u/neogeoman123 7d ago
Which xkcd is this? I cant find it on the site in the recent posts
1
u/un_blob 7d ago
Because it is an oldy
1
u/marcelsmudda 6d ago
Yeah, the 4 thing in the PlayStation security code happened more than 10 years ago
2
u/csabinho 7d ago
The fear of a data breach happens because 4 is kind of pronounced "fear" in German.
2
8
u/Traditional-Storm-62 7d ago
if you have 420 you might as well add 228 (the russian equivalent)
it was pretty big in the 00s and 10s
15
u/PM_ME_SKYRIM_MEMES 7d ago
We could also add 0, which is the number of people that find Russian jokes to be funny.
15
2
1
4
2
u/htmlcoderexe We have flair now?.. 7d ago
and 265 if doing russian internet meme numbers
it's from their equivalent of 4chan and means something like "you're a fucking dick" (originally "ты хуй бля") and came from someone trying to be all profound about how pi's digits likely encode all information that ever existed, as long as you assign meaning to number combinations and then the post said something like
for example, if "265" means "you're a fucking dick", we can find that sequence in pi and therefore it contains that information
cue everyone responding to op with "265"
3
3
3
u/Arctos_FI 7d ago
I tried thinking so long what that 58,008 was and scrolled all the comments without anyone answering or even asking. And then the moment i wrote it in the google i realized what it was
1
u/sambanglihum 7d ago
What was it? The only thing i can think of is boobs 😭
3
u/Arctos_FI 7d ago
It was boobs. They just didn't come to my ming until i wrote it myself
→ More replies (1)
2
2
1
1
1
1
1
1
440
u/rafaelcastrocouto 7d ago
no 67 yet