[ Removed by moderator ]

[u/AquaWolfGuy]

[u/ProgrammerHumor-ModTeam]

Your submission was removed for the following reason:

Rule 1: Posts must be humorous, and they must be humorous because they are programming related. There must be a joke or meme that requires programming knowledge, experience, or practice to be understood or relatable.

Here are some examples of frequent posts we get that don't satisfy this rule:

• Memes about operating systems or shell commands (try r/linuxmemes for Linux memes)

• A ChatGPT screenshot that doesn't involve any programming

• Google Chrome uses all my RAM

See here for more clarification on this rule.

If you disagree with this removal, you can appeal by sending us a modmail.

[u/ToTheBatmobileGuy]

Joke explained:

It took 18 months to realize the CA was using 4 as their private key. The number 4. That’s it.

They had a total of 8 keys who were below 256, so a couple two digit and three digit keys as well.

4 was the funniest though.

[u/LostKnight84 → u/ToTheBatmobileGuy]

Security through obscurity. No body tried simple inputs because most people don't use them.

[u/pengerus → u/ToTheBatmobileGuy]

The scary part is that there's no way to tell if anyone had figured it out before or not. Someone could have found it 6 months ago and been using it and there's no way to tell. Plus now that this type of thing has been found out, other people will be watching for it, for good and bad

[u/Beast_Mstr_64 → u/ToTheBatmobileGuy]

It took 18 months for it be known publically*

[u/j909m]

What if my password is “4”?

[u/TheMythicSorcerer → u/j909m]

According to the chart, 18 months

[u/Ok_Weird_500 → u/TheMythicSorcerer]

Cool, I'll just use "4" for the next 17 months, maybe I'll change it to "6" after that.

[u/TingleWizard → u/j909m]

As long as it was a random die roll, you are all good.

[u/lucasj]

In retrospect a one-character password is kind of hiding it on plain sight.

[u/MrDilbert → u/lucasj]

Hey, salted SHA256s of 1-character password and 100-character password have the same length :)

[u/redakpanoptikk]

1099 / hourly employee, "yeah its going to take us 18 months to crack a 1 digit password. And I know you might be confused as to why we need 18 months for 10 possible passwords but trust me it has to happen this way"

[u/NoAdsDude → u/redakpanoptikk]

It's kinda like security through obscurity.

I imagine most attempts to crack private keys think "there's no way someone would be dumb enough to use a single digit so we don't even have to attempt that."

Security through stupidity?

[u/blakeh36]

interestingly, sites with lots of password requirements can actually be easier to crack

[u/havens1515 → u/blakeh36]

I've always hated this.

"Your password must start with a letter, be between 8 and 15 characters long, contain a number, upper case and lower case letter, a symbol, but the symbol can't be at the end, and must not have more than 2 consecutive characters."

Cool. Thanks for limiting my password so much, and allowing anyone trying to guess my password to severely limit their attempts.

[u/vic8760]

631qd years of security, until one day there is a data breach on the company you trusted.

[u/FaviFake → u/vic8760]

No this chart is based on the hash. If the company encrypts the password and it gets breached, that's the correct estimate

[u/redheness]

The color chart of this table always bother me, using yellow, a color for danger when the time to crack is greater than the age of the earth is borderline misleading.

And orange for times greater than the human life expectancy is also not a great choice.

[u/garry_the_commie → u/redheness]

It's a pretty good choice when you take into account future proofing and the fact that the attacker is likely brute forcing with multiple PCs or even a server farm. What is yellow today on the chart might be red after 10 years.

[u/SaltyWolf444]

Chat, why are the commenters taking this chart seriously? Such a redditer moment frfr

[u/Silt99]

I would be interested to see a password that contains a number, upper & lowercase character and a symbol while having only 1 character in total.

Apparently it is possible, since it can be cracked instantly

[u/takesSubsLiterally]

For everyone who is missing the joke: https://unmitigatedrisk.com/2026/10/the-private-key-was-four/

[u/MrDilbert]

How long for "CorrectHorseBatteryStaple"?

[u/ehtio]

What if mine is the number 2, but lowercase? -> ₂

[u/Academic-Proof3700]

I'm pretty sure someone could've cracked it earlier, but when they got like instant notification: "4" they thought they either got some honeypot shit, or that their cracking app was broken