First screen, captured 3 days ago.

A complete bypass of eMudhra’s 1FA OTP login system

What HN thinks

A certificate authority's login falls to a four-digit brute force, while readers struggle to get past the blog's own bot filter.

Total auth bypass, CA is finished
Commenters read the bug as an unthrottled OTP endpoint that can be brute-forced, so anyone with a user's email can log in and probably get certificates signed. Many expect this to be the end of eMudhra's CA business.
Anti-bot filter blocked humans
Several readers were served garbage text by the site's anti-AI-scraping defence. That led to a side debate about bot filtering, privacy, identity verification and the Semantic Web.
Corporate accountability doubts
Some hope the authorities higher up the trust chain will reflect on this failure. Others doubt corporations or their executives will ever face real consequences.

Consensus: Most agree the flaw is a serious, embarrassing bypass caused by missing rate limiting on OTP checks, and that eMudhra's credibility as a CA is badly damaged.

Recommended in the comments

zygolophodon ↗ (tool): Suggested as a way to read the blocked Mastodon thread through the API instead of the website.
archive.today (service): Shared as a way to read the post despite the bot filter.

Summarised by Claude from the comment thread 3 days ago.

Points: 131
Comments: 53
Best rank: #4
Posted: 2026-10-22 by tensegrist
Category: Security

emudhra otp-bypass brute-force certificate-authority authentication cloudflare-turnstile mastodon

All captures:

Full page

Captured 3 days ago. Click for the whole screenshot.

Looks similar

Screenshot of mastodon.catgirl.cloud: eMudhra Login Bypass

eMudhra Login Bypass (mastodon.catgirl.cloud)

5 points by _ache_ 2 days ago | 1 comments

Screenshot of elk.zone: Potential third critical PHP CVE

Potential third critical PHP CVE (elk.zone)

50 points by mpaepper 4 days ago | 17 comments

A Mastodon thread by security researcher Elise describing a newly found PHP double-free vulnerability affecting 8.4 and 8.5, reported to [email protected] with details withheld.

php double-free vulnerability-disclosure addresssanitizer

Screenshot of twitter.com: Samsung running a TensorFlow lite model on 960x540 image to track you

Samsung running a TensorFlow lite model on 960x540 image to track you (twitter.com)

272 points by mashally 1 day ago | 176 comments

An X post reporting that Samsung Tizen TVs run an INT8 AlexNet TensorFlow Lite model on 960x540 screen captures every few seconds to identify which game is being played.

samsung tizen smart-tv tensorflow-lite