Prince urged browser updates after extremely weak passwords were found on root certificates

Matthew Prince described a problem involving root keys used in internet encryption: an Indian company had used the password “4” instead of the required minimum length of 328 bits, he said. He recalled that six to eight keys were affected and that the strongest password was “136.”

If an attacker can intercept network traffic, such certificates could let them impersonate Google or a bank. The industry distrusted the affected certificates in browsers and operating systems, but unupdated devices might continue to trust them. Prince advised people to install browser and operating-system updates.