alt Hacker NewseMudhra to exit global SSL/TLS certificate business
Comments
> However, the level of social media amplification around this incident has brought scrutiny that is out of proportion to SSL/TLS’s place in our business
Translation: We are exiting this business because people are being mean, and we don't get paid enough.
WTF!
They also say: > We believe an organization's character is shown in how it responds when something goes wrong
I totally agree with this. I will judge their character based on this: No apology for wreaking havoc on the world, no admission of fault, whining about people getting pissed at the monumental incompetence, saying that they are exiting the business because "sour grapes" rather than admit they have lost the trust within the community. <sigh>
If they hadn't done that, I would have expected the browsers to do it for them sooner or later by distrusting their root certs.
This is the exact opposite I hoped to read from them.
I will never trust any brand that even remotely sounds like this company.
Up Next: A subsidiary with a different name continuing the business and taking care of the old emudrah certificates as long as they're in rotation.
Well this was expected. The whole business of certificates is built on trust and after such an incident the trust is gone.
I'm surprised they didn't announce they're going into hiding instead. I'd imagine they probably have themselves covered with user agreements and contracts to some extent, but the potential liability is nearly incalculable.
" My new passphrase is "eMahidra4444". Now I have four-factor authentication.
With over 17 years of expertise, eMudhra is a global provider of digital identity, trust, and security solutions, enabling secure digital transformation for banks and financial institutions (BFSI),
The company’s Global digital signature certificate (DSC), eSign, and other signing services, including those in India, its enterprise PKI Solutions (emCA, CertiNext platforms), emSigner eSignature Suite, and its identity and authentication solutions (SecurePass, emAS) are not affected and continue to operate as normal.
Fuck these clowns, in India to get an import/export license you had get a hardware key via USB from them to access the government portal. Worse yet, their website is designed to look eerily similar to a government website and a lot of people won't even be able to tell it's a private entity.
Now imagine, all the customers who had purchased this key from them have their private details exposed. There was absolutely no mention of this anywhere. Not even as much as an apology. This letter is full of arrogance, deflection and insult to injury. I hope they burn to their ground. It's a really shame the government isn't even stepping in to do anything about this as their customers are the ones that are most impacted because they mandated the stupid hardware key requirement. What a joke of a situation.
In any other country, everyone involved would be fired and there would be serious consequences for such a level of breach (Eg. Equifax). In India, even a class action suit would lead nowhere and the fact that these assholes would be operational still despite this is extremely infuriating.
Ahh right, finding "hacker" news on HN - its still funny how random number generator used literally returned "4"
I think this opens bigger questions on who and how people get access to these capabilities. After that recent cold wallet physical supply chain take over, what sort of people are able to get certs for anything they need?
footer says:
> Ready to Try?
> Talk to our team about how eMudhra can help secure your digital workflows with PKI, eSignatures and identity solutions.
> Connect with sales
“Oh you mean like PIN numbers?”
sixty million certs but couldn't count past 4.
repeat it once for clarity:
it doesn't matter that they left the business, it matters that _they_ continue to be investigated
No apology, analysis or introspection. Why would anyone trust the 99% of their other businesses?
I'm curious how they got into the business in the first place.
From everything that came out they seem terribly unqualified.
Why is it in the 3rd person? It reads like someone reporting on them.
Typical bullshit where India regulations force people in India to buy local - and because the landscape is filled with incompetent and inept companies you get shit like this.
I was already counting on this in my head: Private key, private key, 3, 2, 1...
Kinda funny that logo says "Trust Delivered". They don't seem to have 0 problem with such a big scale damage on public internet and simply trying to shrug off the problem.
This is problem with Indian companies, their founder and management always try to hire cheap labor and penny pinch on everything. And, this is the result we see again and again.
Nevermind the legal liabilities, how is their company viable with this sort of brand damage? Their other business lines aren't making toasters. It's the same line of work. They sell trust.
Not a cryptographer, but I wonder if some sort of basic statistical fingerprinting of the private key being checked at every step of its manipulation during the ceremony would have caught this epic operational failure.
Say, like a multi-scale hierarchical half popcount vector (first/second half, first quarter+third quarter/second quarter+fourth quarter down to odd/even bits), where fumbling one private key for another or xkcd-ing 4 as a private key would be detected, but still reveal no information on a truly random series of bits and be understandable by non-technical people in the room.
Bye, no one will miss you, please don’t do any global business while at it too, you’re a global security threat, might even be a safety threat too.
Smart business decision to have made 10 years ago. Thanks for the mess.
Let's be real - there was no way for them to recover their way out of that after this ridiculously bad screw-up.
Fwiw, the stock is down 40% in the last two trading days.
Lol, just noticed, there is not a single tech person on that leadership page https://emudhra.com/en/leadership
Do they accept invoices for patching their security flaws?
Are they liable?
Terrible company, such evasive statements. Seems ripe for disruption.
Surely they should be investigated by the local regulator.
honestly, props to the c-suite to have enough awareness that this buisness was already dead for them and there was absolutely no pathway where they are getting their certificates trusted in PKI ever again.
this lets them exit this without public humiliation of getting made fun (and example of) in the mailing lists.
How are the Indians that put in ever supposed to get passed the workplace prejudices they experience with outcomes like this.
LOL do the needfull lmao.
The izzat must be protected at all cost!
Once you make a mistake like that, you're basically gone four ever
Why was anyone using certificates from a little known company with no cybersecurity muscle?
yea sure, blame social media cause you are incompetent. nice
"Voluntarily." LMAO.
Oh dear, never mind.
I'm still waiting to read their post mortem with their ~~5~~ 4 Whys
Good. One less company that doesn’t give 2 shits about security. Probably billions in man hours spent deploying mitigations because they can’t manage their keys properly
as part of a review process its not just the developer that wrote the code who gets blamed, its also the reviewer of said code.
Analog
sure eMudhra needs to be investigated and confirmed that even a small part of their business hadn't been used to compromise (it doesn't matter that they left the business, it matters that the investigation continues)
but also we need to see how it is this even happened, who dropped the ball and approved the bad code/behavior to enter in the first place??
or is this a structural issue where we need to introduce more checks/balances (tests)
were they ever really in it?
You better exit when you use a 4 bit key for your root cert
Good riddance, they should also pay a fine for subjecting us to their incompetence.
X.509 needs to be replaced with a simple key you get for free during domain registration. Then the blast radius of key compromise is a single domain name and not the whole internet.