No, the customers for commercial certs are mid-level managers, who believe paying thousands of dollars for something you can also get for free means you are getting a higher quality - or in this case even believe it is "more secure". Rebranding will absolutely work for that, especially when you market your untrusted root as "ISO-certified private dedicated cloud-based PKI-as-a-Service".
The technical people will just install a certbot and use the default Let's Encrypt config.
If they wanted to continue to make money, they could: exit the business, wait a bit, change the company name, and re-enter the business. Where "change the company name" could mean starting an actual new company, but with the same people, offices, contacts (OK, small problem there) and so on.
Yes, its all very well someone here shouting about "the absolutely brutal question battery the Chrome team publicly submitted to eMudhra".
But in all honesty there are serious questions to be asked about:
a) The initial approval process for ANY CA
b) The ongoing monitoring process for ANY CA
The fact this CA was based in India ultimately has nothing to do with it if we are being completely honest here.
Clearly there is a fundamental problem with the overarching approval and monitoring process which means it could have happened anywhere. This time it just happened to be India.
Secondly, in direct reference to the "far away company" comment India does have quite strict controls on both certain technical things (speaking generally here, not specifically in relation to certs ... e.g. use of sat phones). And in general it is quite difficult (read: almost impossible) to turn up in India and do business as an external company. So there is probably a genuine need for an Indian company CA since not every body can/wants to use Let's Encrypt or whatever.
CA approvals are bad. From 2000 to 2015, I ran an org where we allow-listed a modest subset of the the CAs that were approved by Google, Microsoft, and Mozilla. There were too many incidents and bad actors.
Microsoft, in particular, had strong transparency around CA approval processes that were reasonable. It was weird.
Not to give into conspiracy theories but this company might be ideologically even if not materially aligned to current regime in India. With right kind of nudge any kind business contract is possible without any competency.
As a reminder Mozilla was warned not to add the Chinese government as a ca they pushed back claiming lack of evidence and only removed them as a ca once cnnic got caught issuing certs for google domains (by accident )
Yes, not sure what the timeline was where trust was given to this company. Just horrible for the entire secure Internet. They've yet to answer many of the basic questions raised throughout this process too.
If anyone else also struggles to understand all the "4" references in the comments: One of their private keys was "4", with others also being in the 2-3 digit range.
I think this opens bigger questions on who and how people get access to these capabilities. After that recent cold wallet physical supply chain take over, what sort of people are able to get certs for anything they need?
Related: the absolutely brutal question battery the Chrome team publicly submitted to eMudhra
https://bugzilla.mozilla.org/show_bug.cgi?id=2083449#c30
Why brutal? Reads very reasonable to me, nothing personal and nothing about someone or feelings everything about the entity and its obligations.
Reasonably brutal.
I think they brutally expose the utter incompetence of that company.
There's a formal press release in here:
https://emudhra.com/en/press-release/emudhra-to-exit-global-...
"will sharpen focus on... trust services other than SSL/TLS"
Is there some reputation left to salvage here that I'm not aware of? Who would trust them?
They will probably change their name soon
Not so easy. They're a publicly traded company, the regulations are quite stringent.
Facebo...I mean Meta did it to distance themselves from the Cambridge Analytica scandal (among others).
eMuhdra is an Indian company. Maybe the regulations are different in India vs. America?
The customers for certs are technical people capable of seeing past that, so let them change it every day if they want.
No, the customers for commercial certs are mid-level managers, who believe paying thousands of dollars for something you can also get for free means you are getting a higher quality - or in this case even believe it is "more secure". Rebranding will absolutely work for that, especially when you market your untrusted root as "ISO-certified private dedicated cloud-based PKI-as-a-Service".
The technical people will just install a certbot and use the default Let's Encrypt config.
They probably have cash in the bank and want to try to put it into something that might make money. An extreme pivot.
If they wanted to continue to make money, they could: exit the business, wait a bit, change the company name, and re-enter the business. Where "change the company name" could mean starting an actual new company, but with the same people, offices, contacts (OK, small problem there) and so on.
CA Forum, Apple, Google and Mozilla are to be blamed for just giving license to random no security background far away company.
Yes, its all very well someone here shouting about "the absolutely brutal question battery the Chrome team publicly submitted to eMudhra".
But in all honesty there are serious questions to be asked about:
a) The initial approval process for ANY CA
b) The ongoing monitoring process for ANY CA
The fact this CA was based in India ultimately has nothing to do with it if we are being completely honest here.
Clearly there is a fundamental problem with the overarching approval and monitoring process which means it could have happened anywhere. This time it just happened to be India.
Secondly, in direct reference to the "far away company" comment India does have quite strict controls on both certain technical things (speaking generally here, not specifically in relation to certs ... e.g. use of sat phones). And in general it is quite difficult (read: almost impossible) to turn up in India and do business as an external company. So there is probably a genuine need for an Indian company CA since not every body can/wants to use Let's Encrypt or whatever.
CA approvals are bad. From 2000 to 2015, I ran an org where we allow-listed a modest subset of the the CAs that were approved by Google, Microsoft, and Mozilla. There were too many incidents and bad actors.
Microsoft, in particular, had strong transparency around CA approval processes that were reasonable. It was weird.
like most governance body, they check independent audit reports, not the actual operation.
This is a sample on what it looks like during covid lockdown : https://bugzilla.mozilla.org/show_bug.cgi?id=1728790
> Far away company
Far away from it the default country?
Not to give into conspiracy theories but this company might be ideologically even if not materially aligned to current regime in India. With right kind of nudge any kind business contract is possible without any competency.
As a reminder Mozilla was warned not to add the Chinese government as a ca they pushed back claiming lack of evidence and only removed them as a ca once cnnic got caught issuing certs for google domains (by accident )
Yes, not sure what the timeline was where trust was given to this company. Just horrible for the entire secure Internet. They've yet to answer many of the basic questions raised throughout this process too.
I have four (4) takes on the matter.
If anyone else also struggles to understand all the "4" references in the comments: One of their private keys was "4", with others also being in the 2-3 digit range.
Apparently they generated them like this: https://xkcd.com/221/
Smart business decision to have made 10 years ago. Thanks for the mess.
“Oh you mean like PIN numbers?”
https://www.youtube.com/shorts/ZTqEHehcETo
" My new passphrase is "eMahidra4444". Now I have four-factor authentication.
nah, it's still be 2 factor, because 2 is a factor of 4!
I think this opens bigger questions on who and how people get access to these capabilities. After that recent cold wallet physical supply chain take over, what sort of people are able to get certs for anything they need?
eMudhra is primarily used by the Indian government, so not hard to infer how they got into allowlists.
Terrible company, such evasive statements. Seems ripe for disruption.
Surely they should be investigated by the local regulator.
Yes, they are being investigated by the Ministry of Electronics and Information Technology.
https://www.deccanherald.com/india/meity-forms-team-to-probe...
There must be criminal matter here.
Maybe. But not in place where this company resides and does business with the government.
Oh dear, never mind.
yea sure, blame social media cause you are incompetent. nice
I'm still waiting to read their post mortem with their ~~5~~ 4 Whys
Some more discussion: https://news.ycombinator.com/item?id=50195110
This press release was brought to you by the number 4
That's numberwang!
"You can't fire me, I quit!"
[dead]