> eMudhra. you know, the company who had their CA private key as the number Four. this wasn't found by an ai, but just a human using a old ass library made by google called paranoid_crypto to scan through keys for fun out of curiosity
https://github.com/google/paranoid_crypto
> The goal is to increase the confidence in cryptography use cases inside and outside Google. With Paranoid, any cryptographic artifact can be tested, but its primary motivation is to detect the usage of weak third party hardware or software black boxes.
So google didn't use their own paranoid_crypto lib to check the key before adding it to the Chrome trusted certs.
The bad keys weren't added to the Chrome trusted certs. They were intermediate keys, signed by a key that was trusted.