I thought this has to have been the reference

hash salt? Believe it or not, also 4

Fun fact: most implementations actually always use 65537 as the public RSA key (17 was more common earlier, but rare now). It makes computations easier and faster, and doesn't affect security much as long as you pick a hard-to-guess private key. The modulus is the thing that varies in public certificates.

"we'll brute force it, but to save some time we'll start at 5 since noone would ever be stupid enough to use a number smaller than that"

You bonehead! You should have just run a Fourier transform on it.

https://www.smbc-comics.com/comic/2013-02-01

Uh roommate must have predicted the future because this is about a private key for a certificate authority using the number "4" as their whole private key recently. As well as a couple other low digit numbers

https://arstechnica.com/security/2026/10/the-internet-goes-on-high-alert-after-discovery-of-8-compromised-tls-certs/

EDIT: your roommate might have been talking about this XKCD comic https://xkcd.com/221/

I gotcha bud.

It’s a riff on the olive meme.

https://knowyourmeme.com/memes/hungry-but-too-tired-to-cook-try-30-to-40-olives

256 bit and 512 bit encryption are somewhat common. A 256 bit private key is 64 characters long (I’m simplifying this, don’t @ me about it being hex). A 512 bit private key is twice as long. That long string of random characters is what gives this type of encryption its power. It’s essentially unguessable, even with a computer and a lot of time.

Using “4” as your private key would significantly undermine security. Hackers can’t check every possible option for a 512 bit key, but they can certainly (and trivially) try simple numbers padded by 0’s, like our “4” private key.

You’ve taken a strong and proven system and made it trivially weak. That’s the joke. It’s not that funny, but that’s what you’re missing.

Hope that helps.

Happy to hear you enjoyed it (though full disclosure I did steal it)

Basically, when choosing a private encryption key - normally a long string of random characters - in a crucial place for widespread Internet security, some knob just used "4".

https://www.theregister.com/security/2026/10/20/indian-certification-authority-emudhras-private-keys-compromised-one-of-them-was-the-number-4/5304312