Regarding the root certificate issue, yeah, this could be really bad. Only use FireFox, Safari, or DuckDuckGo as your browser (by default, always). Check for updates for your browser and all apps today through the weekend, and install them. Be extra careful about clicking links you receive in messages, email, and posts. With a root certificate, an attacker can spoof a legitimate website and trick your browser or apps into thinking it is real, act as a relay between you and the real service provider, and decrypt any communications you send to the legitimate service they are spoofing. Think wire tap between you and the legitimate service you are using. This could be used to collect passwords, read email, read messages, intercept and manipulate communications from your apps/browser to your service provider. It all depends on if this becomes weaponized, who uses it, and what they use it for. Update your apps and software, and be extra careful about clicking links sent to you.