Sharp Tech with Ben Thompson · Friday, October 23, 2026
A certificate authority in India issued foundational 256-bit encryption certificates using extremely short keys due to a software error that misinterpreted the bit length. Ben Thompson and Andrew Sharp explain that while major browsers have updated to exclude them, deeply embedded Internet of Things devices remain permanently vulnerable.
“A certificate issuer in India, it's not clear what happened. They're blaming software, but these are supposed to be 256-bit encrypted devices. So 256 unique digits or letters or numbers or symbols. Their numbers were like four. Or like 127. A little easier to decrypt.”