Crypto users should care about this too, mostly outside the browser. Exchange bots, trading scripts and wallet backends often run on Python, Node or Go. A forged certificate for an exchange’s API could let an attacker on the same network read or change a bot’s traffic. No crypto attacks have been reported, and no attacks on users have been reported so far.
CoinDesk contacted eMudhra for comment.
Mozilla browser warned that network interceptors could use these fraudulent certificates to impersonate trusted sites, allowing them to read or alter the user’s data.
Mozilla got the report just after 8 p.m. UTC and had a block in place about three hours later. Chrome blocked the certificates the same day. Apple followed on Oct. 19 and Microsoft on Oct. 20. eMudhra has also revoked them.
How the keys got out is still unclear.
“According to researchers, eMudhra used tiny integers like 4, 56, and 237 as private keys instead of strong 384-bit…
