Hacker News

It was "multiple human errors". But yeah no matter what, in any case or exceptional circumstances, this thing was not supposed to be screwed up.

On Mozilla’s tracker, eMudhra said the keys were created on 30 April 2025 in a key generation ceremony, a recorded procedure in which keys are produced inside hardware security modules (HSMs), tamper-resistant devices built to hold keys. The keys were meant to be moved to data centres in the United States and Europe for customers needing data stored in those regions. To move them, the company added a step to ‘wrap’ each key, or encrypt it for transfer, and ‘unwrap’ it at the other end. eMudhra said a flaw in the software script created a second, weaker set of keys during this step, and because the two sets had similar names, staff used the weaker ones by mistake. It said human errors occurred at multiple steps.

source:

What's the eMudhra security scare that has rattled the internet?

https://theprint.in/tech/whats-the-emudhra-security-scare-th...

Their complaint about social media reeks of "and we would have gotten away with it, if it wasn't for those meddling kids". [1]

[1] https://www.youtube.com/watch?v=hXUqwuzcGeU

Their OTP solution is bruteforceable as well: https://mastodon.catgirl.cloud/@49016/117475921584308861

Various Indian regulations (particularly around commerce and banking) require you to use India companies for solutions like the above. It gets worse when companies are "steered" by a regulator/compliance person who has a bias for a specific solutions provider.

"out of proportion to SSL/TLS’s place in our business" is an insane comparison. They are saying they care so little about SSL/TLS to begin with that it's not fair.

It would be like me practicing surgery 1 hour a week and saying "well surgery only has a very small place in my 80-hour work week" in response to flagrant failure of medical care.

This is what I found regarding how it happened, but still not a full explanation - but there was some name confusion and obvious incompetence.

>According to eMudhra, proper strong keys were created in the HSM at the key ceremony on 30-04-2025. The script had been changed to test wrapping and unwrapping keys, because the intermediates were to be moved to data centres in the US and Europe, and a bug in that change created a second set of weak keys. The keys had almost identical names, and the weak ones were used for the certificate requests. The same request was signed by eMudhra's own root and sent to Sectigo, which cross-signed it. The strong keys never made it into any certificate (Bugzilla).

https://www.fairssl.se/en/articles/emudhra-ca-noegler-knaekk...

Right? I don’t know why anybody would trust this company for anything.

Russian Roulette is pretty accurate if not an understatement.

If they expect people to still trust them on their other services they have obviously no clue on how Trust works, meaning they shouldn't be in the game in the frist place.

As a trust provider you get one chance. Squander it and you're out. That is how it should be.

Anyone relying on them with anything related to security or trust is playing Russian roulette at this point.

In any legal dispute involving them, Exhibit A will be "look at how they ran their SSL/TLS business". That won't go well.

They got their image hurt, and pulling the culturally appropriate response here which is to never apologize and to never accept fault. Instead quit/resign and say that other stuff is just fine. It's really not fine, and you can bet that the same corporate philosophy that made the CA error will have serious security errors in their other products.

I think it doesn't matter what they say because they'll just get away with it. It's as simple as that. They'll get away with it.

The internet's security relies on an almost impenetrable wall built around it. The king appoints gatekeepers that are each entrusted with a gate they must protect. The gatekeepers must follow a rigorous interrogation process to verify the ID of anyone who wants to pass through their gate. Only then are they permitted to unlock it.

The king was very careful to ensure all the gatekeepers were following the process correctly. It did not occur to anybody that one of the gatekeepers could be using a dirty rag to jam their gate closed instead of a lock.

Once discovered, the wall could be trivially bypassed. The security of the whole internet was immediately broken. Rebuilding the wall to block up the dodgy gate took much effort from very many people.

In the old days a king would "sign" his proclamations by pressing his "unforgeable" signet into a wax seal. This proved the authenticity of the proclamation.

Normally, the king would declare and sign a proc stating that anything signed by his secretary's "unforgeable" signet was to be respected as well. The secretary could delegate authority to others in turn.

Well turns out that one of the signets in the chain of trust was just a picture of a "four" that anybody could have forged, but nobody noticed because in all of the ceremony and stacks of parchment with wax seals, nobody actually checked if the signet was secure.

https://bsky.app/profile/anthonymoser.com/post/3myf5fwpl7s2t is a good explainer I think without getting into the nitty gritty details.

  for the non technical folks:  imagine there was a password that if you guess   it, you can impersonate *any website on the internet*
  
  now imagine the password is literally the number 4

I just explained what it actually is. I said "you know how you go to a website HTTPS and it's secure? Well Apple chose a couple of trusted parties that your phone inherently trusts, and those people approve a few thousand intermediate companies who do the day-to-day certificate work for end websites. One of those intermediates, rather than choosing a 200-digit random number, chose 4, no not four-digits, the number 4". And then we could laugh at some of the memes.

It's hard to explain partly because when you explain this thing we've done with TLS and PKI, it sounds a little insane.

> "We set up a system where every government and a bunch of random banks and IT companies in the world holds the secret codes to everyone's encryption. Then we make them pinky swear not to abuse it, with stern talkings to if they do. And now it's all on fire, because one of them was irresponsible!"

You can know the intractability of the problem that PKI is solving, and the (worse) alternatives that have been tried, but that doesn't make this system not-insane to a normal person, and its at least a little bit the fault of the collective "us".

And it's not like it is an impossible problem; we rely on TOFU for SSH, we have remotely-attestable TPMs everywhere, ZKPPs / PAKEs exist, session keys and federation protocols are widespread. Somewhere in the set of "possible solutions" are options that don't sound unhinged when you explain how we got to this eMuhdra situation.

The internet is a marketplace with a million vendors, each with their own stall.

In order to sell something in the market, you need to prove that you are who you say you are. There are about 200 trusted clerks whose job it is to check your papers and verify your identity. Once they're satisfied, they stamp your papers with an intricate stamp designed by the finest cryptographers.

Anyone seeing that stamp knows that a trusted clerk has checked your identity and approved your papers. Most people don't examine the stamp closely. They simply recognize it as belonging to one of the trusted clerks and accept it.

One of these clerks, however, instead of commissioning an intricate stamp from a master cryptographer, bought an ordinary rubber stamp from an office supply store.

One day, a particularly paranoid cryptographer was examining the stamps used throughout the market and noticed something peculiar about one of them. It wasn't intricate at all. In fact, it was so simple that anybody with a few dollars and a trip to the office supply store could make an identical stamp.

The clerk's job wasn't merely to stamp papers. The clerk was supposed to check that everything written on them was true before applying the stamp.

But now anyone could write whatever they wanted on their own papers and stamp them. The resulting documents would look exactly like ones that had been carefully checked and approved by the clerk.

A robber could write "thebank.com" on their papers, stamp them with the office supply rubber stamp, and present themselves as thebank.com. If they could get a customer to come to their stall instead of the real bank's, the customer would have no reason to suspect anything was wrong.

After all, the papers had the stamp of a trusted clerk. And everyone who trusted that clerk's stamp would believe them.

I told my wife the following: basically when you access a website like your bank, and you see the padlock in the address bar, that means that the computer the website is on has shown your computer a certificate saying that the same company that built the website you’re looking at owns the web address you’re going to.

Your computer has a built-in list of signatures that it trusts and expects to see on the certificates, and one of those signatures was eMudhra’s. These signatures are basically just a proof that you know a secret number without revealing the number itself. If you know the secret number, you can sign the certificate.

There are an unimaginable number of secret numbers. Imagine each atom in the Great Pyramid of Giza is a secret number. And then imagine you have as many Great Pyramids of Giza as there are atoms in the universe. And then double it.

Now imagine you choose any of the numbers represented by all those atoms to sign the certificate with, and you chose 4.

It’s not technically wrong: 4 is indeed a number. But if anyone wants to guess your number, and they start at 0, it won’t take them very long to find your secret number.

Once they’ve found your secret number, they can now sign certificates pretending to be you. So someone could pretend to be your bank, and present a certificate saying “yes, I am your bank” with a signature on it that your computer trusts.

A car manufacturer that reused the same car key for every car.

>I can't come up with a metaphor or parable that's even remotely as ridiculous as what they've done

The best example I can think is (some) international borders: yeah, they're heavily regulated entities with lots of written protections (and thousands of miles of impenitrable barricades), but occassionally a hole opens up (whether physically or engineered).

Perhaps a section of border fence is occassionally destroyed (and people sneak in), but this won't happen if the border guards are approving [false] passports from a compromised government actor ("they have a valid passport, according to our inspection"), the border fence doesn't even matter!

Presume anybody can now go to that bad-passport-issuing government and request a passport to then enter any other country (i.e. the other country will see the passport as valid in the official global database): BAM, borders no longer mean anything; welcome to Privileged Accessia.

Everyone in your neighborhood knows your address, but someone discovered two days ago that they can get into your house by sticking a 4" oblong piece of paper into the keyhole. They put it on blast on Facebook, so now everyone in the whole planet is trying to break into your house.

keep it simple. They promised a door key with 10 grooves cut in it, but instead they gave you a door key with 1 groove cut in it.

And when that clicks, extend the metaphor, literally, to a key with ~384 grooves.

This scene from the classic comedy movie Spaceballs is a good one: https://youtu.be/B-NhD15ocwA?si=pcPfIRTgPVAurW1S

y'all underestimate your wives, i simply explained how PKI works in simple terms (alice/bob, public key, private key) and explained that they chose 4 as a private key instead of something complicated, she got it.

I have explained it to a few normies.

I start by saying this is about the tech behind the S in HTTPS. I say that the main point of this is that when you talk to foo.com, it has to prove that the people behind foo.com are on the other end, so it's safe to send them your encrypted password or whatever.

Then I say a bit about how the system works by having a small number of trustworthy companies vouch for other people's servers. This doesn't need too much technical detail to get the point across.

Then I say one of those "trustworthy" companies put an encryption key of 4, where it's supposed to be a long number that's hard to crack. This makes the verification easy to forge.

Then I say that everybody who runs a server needs to remove this company's bad key, and Windows or Mac or your phone needs updates too. And that your web browser probably already quietly removed it, which removes a lot of the risk.

I feel like when I explain it this way people get it.

A lock factory that’s supposed to make unbreakable locks, yet all of the locks/keys are identical. Suddenly everyone can use such a key to open any door of the internet.

Not 100% accurate, but conveys how stupid and incompetent all this is.

It's like finding out that all the deadbolt locks made by a company can be opened by an uncut key blank.

I told my fiance it was a bit like if a company that produces keypad door locks accidentally added a master code (115) which works on every single door and has for the last two years.

Yours is much funnier!

You know how we got a lock on our door, and it opens only with our key? Turns out someone made a lock which looked secure, but actually opened when you said the word "friend" - and then engraved "speak, friend, and enter" on the door.

  - you know how some people have passwords like 1234
  - ha ha yeah what idiots
  - what do you think an internet infrastructure company password is like
  - idk something long and hard to remember
  - 4
  - lolwat

A car manufacturer sold cars that had straight keys with no teeth for years and nobody noticed.

How about, someone is selling a secure box of some sort, and their factory starts putting glitter nail polish over the screws that hold it together, as is sometimes done for security reasons.

Then the intern decides, “I can just glue these identical little white circles with blue sparkles onto the screw, and it will be faster and I can take more breaks!”

A special locksmith who's entrusted enough to do the locks of all the important bank vaults in town used the pass code 1234 for every bank vault in town.

It's like if a manufacturer of bank vaults accidentally let all their vaults be opened by the code 0000

From Spaceballs:

https://youtu.be/a6iW-8xPw3k?is=IFYVVkYnlKQk1uh7

https://www.youtube.com/watch?v=_JNGI1dI-e8 except the password is for everyone's luggage, and it can't be changed

I described it like it was a company selling the highest security locks to companies that needed them, then one day someone discovered you could open the door with a toothpick.

The Hyundai/Kia cars where a USB-A connector fit the lock actuator and was enough to start the car, so enough got stolen that insurance companies stopped issuing policies for them.

One company prints identity cards with a hologram to prevent copying. Another company puts on a dot with a crayon.

concrete manufacture occasionally builds houses.

house collapses and people get injured.

concrete manufacture says we no longer build houses cause it’s too small of a business.

It’s like the skeleton key for all the locks in the neighbourhood is actually just a straight metal rod.

They cut a key for their lock, but instead of using the 4-5 tumblers they only used 1.

Its like finding out that for many years every minuteman silo in north america used the launch code "00000000"

we could stick with the metaphor of keys. The modern web requires fancy ones capable of hundreds of notches. The company in question basically skipped the step of notches and just used the blank key

"We're designing/running the lottery. You get to pick the winning numbers, in secret, obviously so no one will know. There are millions of numbers you can pick from, using a random system so it's all trustworthy. Instead of drawing a random ball out, and another and another, you write down the number 4 on a bit of paper and go home for the day thinking it's a job well done. No one noticed because they all expected it to take up to a million guesses, until someone just asked if it was 4"

There’s an xkcd for this: https://xkcd.com/221/

Low quality tech company cuts corners seems pretty on point

Ever seen Spaceballs?

“That's the stupidest combination I've ever heard in my life! That's the kinda thing an idiot would have on his luggage!”

Why do you need an analogy? Analogies are always bad. Encryption relies on long complicated numbers, but they made the number instead of long and complicated just the number “4”. Which is actually harder than using a long and complicated number because it’s basically all automated so we don’t even know how They fucked it up this bad.

I'm also wondering who the hell would use a registrar called "eMudhra" with Arial font in the subtext in their logo. It's so incredibly 90s.

I'm actually being serious, I do judge companies by their logo and website design taste, and more modern-looking companies also tend to pay more attention to doing things properly.

They put a lot of effort into building a very secure safe, thick steel walls, can survive a fire forever, too heavy to move.

Then they locked it with the key you find on a chew toy for a baby.

i explain it by using Donald Trump: There is the atomic football (a case traveling with Trump so he can initiate a atomic war even while playing golf). The combination of the lock an the "Football" obviously is 0-0-0-0-0-0, But Tramp has problems remembering the order of the digits in the combination.

Why brutal? Reads very reasonable to me, nothing personal and nothing about someone or feelings everything about the entity and its obligations.

Offtopic: collapsing comments with a flair like ‘off topic’ or ‘me too’ is a great idea and really adds to keep the discussion on track.

This was a good read on the situation, thanks for the link.

Is the Mozilla bugtracker usually a / the Go to party for these issues? Or just a coincidence in this case?

oof. even as a bystander i’m feeling the cortisol just reading the questions. i’m curious what even goes into compiling this list of questions - did they plan on going for the kill?

EC, not RSA. RSA would *never* allow something like that.

It would need to be a 3, 5, or 7, since a prime is required.

You can't do that because an RSA private key contains two numbers - the modulus and the exponent. Even better, an RSA private key usually has the modulus stored as its two factors rather than their product.

Also note that using small numbers like 65537 for RSA public exponents is common practice.

That's INSANE

Like, that had to be malicious right? ssh-keygen won't generate a key like this, and neither will openssl or whatever Microsoft is doing behind their CA server.

https://www.youtube.com/watch?v=u8ccGjar4Es

-----BEGIN PRIVATE KEY----- MIG2AgEAMBAGByqGSM49AgEGBSuBBAAiBIGeMIGbAgEBBDAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAShZANiAAQTglHNUqyS mMHIqtl3Mh3rl+cJvQtMoKylXcitUdz8nRWJoVl+OlEg4e/WMcY+GDXKyuKYaaYu FjHoooGBq1ZhbcRdkYq8CfOrDmPPeSqk3O1zh743u6VpVJ8cArJw7Wc= -----END PRIVATE KEY-----

The key needs to mention which curve it is using.

> -----BEGIN RSA PRIVATE KEY----- 4 -----END RSA PRIVATE KEY-----

The "4" would be valid in hex, decimal, and even octal.

BEGIN EC PRIVATE KEY, surely?

I don’t see a problem. Isn’t that the official random number?

https://xkcd.com/221

We don't know what passwords other CAs have.

technical accuracy aside, this made me giggle like a madman

Annoyed that you've posted this, now I need to go increment all the private keys on my servers. >:(

People have been saying that CAs are a bad idea since CAs were first proposed.

The problem is that those same people tend to disappear as soon as you ask "So what should we do instead?"

The largest problem is that you trust the entire set of commercial entities (in any one of them can destroy the world's security by itself), and the set is semi-secret (in no party using them actually knows what the set is).

Almost all browsers require certificates be recorded in Certificate Transparency logs <https://en.wikipedia.org/wiki/Certificate_Transparency#Manda...>. Since those logs are empty in this instance, you can state that no one used a forged certificate with a mainstream browser, which is the most obvious (and desirable) attack type.

Well, none came out of the Certificate Authority.

They just didn't mention that now anyone can be their own Certificate Authority.

You can also monitor if they show up in certificate transparency logs. Which won't catch all fraudulently issued certs, but might show up some, especially if it's being widely abused.

Maybe; if you were asleep for 13.5 of them.

If you go by the timelines here - https://bugzilla.mozilla.org/show_bug.cgi?id=2083449

It was ~15hrs 30 minutes to first revocation

Maybe if it's not your core business. I guess.

4 would've been far more diligent.

no

This is generally how Indian managers do damage control. Don't trust a single word. Even my Indian manager told me to not trust Indian managers.

Why would they? They weren't secure! ;)

It fell by exactly 20.00% because it hit the NSE's lower circuit, which prevents trades below that price for the rest of the session without technically halting trading. This is effectively a trading halt because there are presumably no buy orders at the asking price, and the real value of the asset is likely much lower. [1]

[1]: https://www.nseindia.com/static/products-services/equity-mar...

-20% is today's movement, it is -37% on the 5 day (which includes the data from yesterday).

It looks like them explaining that certs are only a small part of their business did not fly with shareholders.

I think it is not that people do not take things seriously. It is that there is no bandwidth for them to do so. I used to live in India, now don't live in India.

If I had to battle 2 hours of Indian traffic just to reach office, while I am also stressed about things I have to do with the city office to get my apartment approved, while also having to deal with all the plumbers etc who just call at random times, and while also thinking of having to fix my car, and none of this is easy. Everything is fucking hard, I would have no mental concentration to do these ceremonies properly as well.

I look at some of my friends in India, there's just so much daily work just to get by. Easily 4-5 hours lost everyday just for useless mandatory stuff. On top of 9 hour of sleep and 6 hours of eating, cooking, washing stuff, exercise, bathroom, you are left with 4 hours of actual work you can do per day.

So most Indian employees are unfortunately only able to work at 50% productivity. And then it is not surprising that they make mistakes.

sounds like "meeting compliance" is inadequate, and "compliance" needs to be increased. A rising tide raises all boats.

Yes, but in the end that's not their fault, and in a sense it's good that this happened. It was well understood from the invention of security certificates that private keys might leak and certificates will need to be revoked. Systems that were not designed with this in mind should never have been deployed, and should now be decommissioned and replaced.

It might even be sensible to intentionally revoke a small number of certificates every month, to make sure nobody is complacent.

It baffles me that software on Linux/Windows/MacOS doesn't just use the system certificate store, then it would just be a single place to update. Instead we need to be update pip, UV, node, etc separately.

I can see the case on phones: the OS may no longer be supported by the vendor, so browsers shipping their own set makes sense. And on embedded there isn't (and on IOT there might not be) an OS, but then you should probably just ship the the single CA that you use, not all of them.

It rages me as well. Some random attacker could have MITM attack any https website without being noticed by anyone(including eMudhra), surely it won't contribute any to their revenue!

Python shipping its own CA bundle is a criminal offense all on its own.

sounds likethey're making an argument for distrusting any CA for whom CA operations aren't a core part of their business.

I mean, yeah I get your point but also if these pieces of the stack weren't prepared to deal with a compromised CA, then they were also at least a little bit negligent. There's always a chance this is going to happen. There's a chance it could happen and there not be any negligence or incompetence on the part of the CA

But at the end of the day if you're not prepared to revoke the trust of any CA you trust, it's a you problem

Part of it is on everyone else for not actually testing they key strength.

I pointed this out yesterday and people thought I was nuts:

https://news.ycombinator.com/item?id=50189521

I suspect Apple published no update and is relying on the CA's CRL and/or OCSP to do its job. But it's rate-limited, the connections time out, and iOS is hard-coded to soft-fail.

Like you my trust store is months old.

That said, I found separate installs of Firefox and Microsoft Edge that accepted *all* the bad certificates without a care.

The only browser that consistently rejected all of them was — you guessed it — Internet Explorer. A browser so old it couldn't even run the test properly but it did what it needed to and blocked all the servers.

iOS absolutely uses a CRL, and Apple has revoked the eMudhra certs as of this morning: https://www.macrumors.com/2026/10/22/apple-blocks-certificat...

Do you have battery saving mode on? I think it blocks the background process that updates. I had the same issue but turning it off and waiting 1 minute started blocking all the certificates. This is for iPhone 13.

> Your browser trusted 4 of 14 compromised certificate chains.

Just now on M1 Pro Safari.

On M1 Prp Firefox: none.

On iPhone 17: Safari: none, Firefox: none.

My iPhone 12 is fine, so its not that Apple has done nothing, but there must still be issues with getting this to all devices?

I'm pretty sure Apple does use CRLs, but for some reason your phone has a problem fetching them. Yesterday my iPhone SE running iOS 15.8.8 did connect to the sites, but refused to connect about 30 minutes later.

My previously working, then broken iOS and iPadOS browsers now work and have done for the last hour. Who knows why.

My iPhone 13 has all those certs blocked.

“Did not connect” for me, from your second link, on iOS 27.

Country specific CA that can only sign ccTLD actually make sense to me

I was thinking exactly the same and thought I must not understand how it works, no idea why I should trust any CA's on the other side of the world.

They will probably change their name soon

They probably have cash in the bank and want to try to put it into something that might make money. An extreme pivot.

If they wanted to continue to make money, they could: exit the business, wait a bit, change the company name, and re-enter the business. Where "change the company name" could mean starting an actual new company, but with the same people, offices, contacts (OK, small problem there) and so on.

Well that was quite the ride.

It's more like they tore down the entire barn.

Do you think they left because they figure they’d never get enough trust back to make it worth trying?

... maybe someone needs to go look into those HSMs generating them keys ... especially from the company who manufactured the HSMs for eMundra ...

“Trust, Liberated”

5

Immediately and totally exiting the domain is about as close to admit you messed up and call it a day as you'll ever get from a modern company.

The statement can use whatever weasel words it likes, but the action pretty clearly says "we aren't mature enough as an organisation to handle this responsibility." Which would be quite the concern for me, if I were a customer for one of eMudhra's other product lines.

I do agree it is out of proportion, they deserve a lot more amplification

DigiCert threatened legal action against companies that asked them embarrassing questions after they had to revoke certificates due to a bug.[1]

It raises the question why these CAs agree to participate on this forum and then complain about doing so.

1: https://bugzilla.mozilla.org/show_bug.cgi?id=1950144

> admit you messed up

You apparently don't understand Indians.

Culturally, that reply makes perfect sense.

e.g. Japanese culture in many circumstances requires a company to rush to apologize for the smallest perceived (not even actual) fault

> Just admit you messed up and call it a day.

learn about Izzat and Jugaad in their "culture". That explains the problem itself, as well as the reaction ;)

"We didn't care about that part of our business anyways!" And the outcome clearly shows that.

The key was enough of a statement of TLS's place in their business. No new information here.

To admit having messed up they would need to include the full private key in the post, which they seem to have decided is still more embarrassing than not including it.

What I hear is that he is saying that the SSL/TLS business is only a small part of their overall business and that they can close that part down as a result of the loss of reputation for that this has rendered.

While I admit their explanation is questionable, they did admit they messed up.

I see this more as "we didn't know this was so complex and the juice no longer looks worth the squeeze."

The gall to write that after using the integer 4 as a private key.

Jesus H Christ these guys had literally the number 4 as their secret and they call telling them they're incompetent an "out of proportion" reaction?

We are high caste.

Plus „scrutiny“ - a company is a trust line of business shouldn’t be afraid of scrutiny

Probably just a botched translation though

There must be an uncountable number (>237) of social media posts about them by now.

"We've been caught out showing that we didn't know what we were doing. And we think people sharing that is disproportionate"

A weak minded action doesnt produce a win for all parties involved. In fact I applaud their bravery.

Clearly you never had a manager from India, otherwise you’d know this is standard protocol.

Oh wow. The audacity to gaslight!

this ^^^, you can't just exit the business and wash your hands

Yes, its all very well someone here shouting about "the absolutely brutal question battery the Chrome team publicly submitted to eMudhra".

But in all honesty there are serious questions to be asked about:

a) The initial approval process for ANY CA

b) The ongoing monitoring process for ANY CA

The fact this CA was based in India ultimately has nothing to do with it if we are being completely honest here.

Clearly there is a fundamental problem with the overarching approval and monitoring process which means it could have happened anywhere. This time it just happened to be India.

Secondly, in direct reference to the "far away company" comment India does have quite strict controls on both certain technical things (speaking generally here, not specifically in relation to certs ... e.g. use of sat phones). And in general it is quite difficult (read: almost impossible) to turn up in India and do business as an external company. So there is probably a genuine need for an Indian company CA since not every body can/wants to use Let's Encrypt or whatever.

> Far away company

Far away from the default country?

like most governance body, they check independent audit reports, not the actual operation.

This is a sample on what it looks like during covid lockdown : https://bugzilla.mozilla.org/show_bug.cgi?id=1728790

Not to give into conspiracy theories but this company might be ideologically even if not materially aligned to current regime in India. With right kind of nudge any kind business contract is possible without any competency.

As a reminder Mozilla was warned not to add the Chinese government as a ca they pushed back claiming lack of evidence and only removed them as a ca once cnnic got caught issuing certs for google domains (by accident )

Yes, not sure what the timeline was where trust was given to this company. Just horrible for the entire secure Internet. They've yet to answer many of the basic questions raised throughout this process too.

> Two-bit salary, 3 bits of entropy

Brutal but sad

https://xxcancel.com/shobhitic/status/2112875765570359475

Wow, the maximum salary in the range posted there is 6 Lakhs per year (LPA), which is roughly equivalent to $528 USD a month. So the HIGHEST paid developer is making only $528 USD a month. That's insane. The average salary in Bangalore for a software dev is around 12 LPA, and is often as much as 30 LPA. They're topping out at half of the average. Many Western companies pay >100LPA (equiv to $100k/yr USD) in Bangalore. For reference, eMudhra is headquartered in Bangalore. This isn't just low by international standards, this is very low pay by local standards.

If anyone else also struggles to understand all the "4" references in the comments: One of their private keys was "4", with others also being in the 2-3 digit range.

Apparently they generated them like this: https://xkcd.com/221/

The Ministry of Electronics and Information Technology (MeitY) on Wednesday said it has taken “serious note” of the reported security incident

Will they send a "strongly worded letter"? That's the best way to make sure such an incident never occurs again. /s

Vibing...

> There were no end entity certificates issued out of the affected CA’s.

What does this mean from the press release? Were they only issuing other chained intermediates? Or did they never issue any ECC certificates from these at all, and everyone is paying the price?

I wonder if big roots with chained intermediates will now need to have serious pressure on their downstream intermediates to re-prove their need to exist. I know RHEL and Debian's strategy (if not others) was to pull the Comodo AAA Services root as well ...

# of issued leaf certs isn't a great indicator of propagation, user-impact, revenue etc.

1. 59 million of those 60 million could be very short validity, duplicate enrollments from same private key/csr, etc. 2. I'm still not certain that that figure isn't including for example private roots/intermediates they've issued from.

That said they're a low volume (in terms of root/int) provider so I don't think the impact of them exiting will be great.

That's numberwang!

That's virtually all businesses.

#1 Executive bonuses

#2 Shareholder value

...

...

--//--

...

...

#NaN customer trust

#NaN security

How does a client know what public key to expect for a given domain, then?

If they key is distributed by DNS, then you need to secure DNS, e.g. with DNSSEC. Well, with DNSSEC the TLDs and root basically have the same status as CAs (although it does cut down the huge number of CAs that can issue certs).

You mean like DNSSEC DANE?

The blast radius of that is every subdomain of whoever got compromised. Having only ICANN being capable of breaking the entire internet is a world of difference from what we have today, and may be the best we can do... and we should be using that, but it's not perfect either.

I mean isn't closing up shop for certificates kind of giving a reason for them to toss/burn all evidence before its asked for

"Oh sorry, we erased the evidence because we no longer had use for it"

nah, it's still be 2 factor, because 2 is a factor of 4!

eMudhra is primarily used by the Indian government, so not hard to infer how they got into allowlists.

Guessing they started with 1 and have worked their at up to 4

agreed, its not enough to fault the aggressor, its necessary to punish the enabler

Passive voice is a common technique to avoid taking responsibility.

Sure there was - rebrand and change names, maybe once or twice until the public loses interest to keep talking about it.

Or silently spin out a subsidiary under a new name who takes over the cert business, and redirect existing customers there for renewals.

Yes they didn't close down the business, it was already gone. There's not a business called "selling certs that aren't accepted by any browser or OS". That's not a product.

Absolutely no way any OS or browser manufacturer forgives them and let's their certs validate anything in the future.

> Kaushik holds a Bachelor's in Computer Engineering (member of Tau Beta Pi) and a Master's in Computer Engineering with a focus on Networking

First one I clicked on?

True, but the founder's two sons are at the top of the company, so mission was accomplished regardless.

Really though, this is no different than people relying on accountancy firms in the rest of the world for "trust" and "security" as technology concepts. Accountancy firms have no business consulting on technology topics, and yet that is a major part of their business all over the world, because we've allowed "security" and "compliance" to become muddled concepts.

That presumably depends on your tolerance for bureaucracy and pain.

Yes, they are being investigated by the Ministry of Electronics and Information Technology.

https://www.deccanherald.com/india/meity-forms-team-to-probe...

There was no cyber attack here. They released a cert with a trivial key. They sold a lock with no pins. When people realized what was being delivered, they blew the whistle. They were killed by a self own of epic proportions.

Maybe. But not in place where this company resides and does business with the government.

Web PKI doesn't work like you think it does. I can use eMudhra's private keys to forge a cert for your website. You don't have a choice in this.

Worse yet, why is that CA even part of the Root CAs shipped on all the modern devices?

My trust in those vetting the CAs is completely broken now.

It might have been little-known in your corner of the world, but I understand it's definitely not little-known in India.

You might have heard of DigiCert or IdenTrust, but what, exactly, makes them trustworthy, and why eMudhra wouldn't be considered trustworthy (a week ago)?

You might have heard of this "sovereignty" movement: sovereign OS, sovereign cloud, sovereign AI?

One man's "little known company with no cybersecurity muscle" is another one's "sovereign certificate infrastructure."

It mostly does not matter. They don’t have your private key, and EVERY trusted CA can miss-issue in your name, regardless of who you pick.

That’s sort of the problem the CA forum (badly) addresses. The consumers of the CAs are not specifically exposed to failures of the CA they choose.

eMudhra was a root CA. Their roots and intermediates were cross-signed by Sectigo since it was a new(-ish) root CA (a comment on Reddit characterized eMudhra as a Sectigo reseller, but I can't find verification of that), but I don't know to what extent that was done as a result of Sectigo's own evaluation vs. some internal process of a larger entity like the CA/Browser Forum. (Without cross-signing, it's difficult for a new CA to operate, so I imagine there must be some process by which a particular existing-CA cat is belled to be the cross-signer.)

No? DANE is a dead letter. It doesn't work reliably on all Internet paths; too many middleboxes flip out if they see a DNS packet that doesn't look like every other DNS packet. For many years, there was an effort to work around that with "DANE stapling", where the signed DANE records were tacked on to the TLS handshake. But that leaves a chicken/egg problem, because attackers can strip the DANE records out of the handshake. The project was abandoned several years ago, and with it any real prospect of DANE becoming mainstream.

I think that's for the best; there are much bigger problems with DANE/DNSSEC than TLS reliability.

This all day. There is no reason I should have to go through a third-party to get a certificate just to distribute a key for secure communications (which is all a DV certificate is good for) if I already own a domain, or can get the domain owner to publish my TLSA record in theirs (which should be no more onerous than publishing the server A record, which they already have to do).

The reason we don't have DANE support in browsers is of course because Google decided not to implement it in Chrome, because (ultimately) the key lengths securing the root DNS server zones weren't large enough to suit them (at the time, 1024 bits):

https://www.imperialviolet.org/2015/01/17/notdane.html

And if Google wasn't going to do it, it didn't make sense for any other browser to do it either.

However, I believe the root zone keys are now longer, so I could (potentially) see Google implementing DANE in Chrome now, maybe with a Chrome-specific restriction of "TLSA records that have keys under 2048 bits in their chain of trust are ignored" (since the root zone keys are not the only keys in the chain and they want to eliminate 1024-bit RSA from Chrome). And if Google does it in Chrome, then everybody else has to do it too, so the situation flips.

Some of your recent comments have been killed by our software because they've been classified as genai text, which is not allowed on HN itself (see https://news.ycombinator.com/newsguidelines.html#generated and https://news.ycombinator.com/item?id=47340079).

(Of course it's fine to use AI tools! We use them heavily ourselves. Just please don't use them to generate or edit text to be read by fellow humans on Hacker News itself.)

It's impossible to know for sure what was LLM generated or edited, but we have to rely on imperfect classifiers or else the site would be completely flooded by genai text, which is not what the community here wants to read, nor in the intended spirit of HN.

LLMs had nothing to do with this.

Good. Let it burn. It's not that GPT-x is dangerous, it's that the security practices that it's pointing out are.

I wish any company that gets sunk by this a very happy go-out-of-business.