Oof. Reading this points out just how many devices won't or can't be updated to distrust the weak CA keys disclosed today. https is barely, if at all, more secure than http now, for those devices.

There's even the scenario where your phone asks Google or Apple if there's an OS update and they would like to say "yes, here's an update to your root certificate store", an attacker could now impersonate them and instead say "no, everything's fine and dandy".

Lovely.

Eight Bits of Trust; eMudhra's CA keys cracked in milliseconds

One of eMudhra's certificate authority private keys is the number 4. Not a number that starts with 4, or the number 4 followed by a few hundred random digits, just, 4... Another one is 56, and another is 115.

^{Scott Helme}