eMudhra to exit global SSL/TLS certificate business

I'm curious how they got into the business in the first place.

From everything that came out they seem terribly unqualified.

I was already counting on this in my head: Private key, private key, 3, 2, 1...

sixty million certs but couldn't count past 4.

as part of a review process its not just the developer that wrote the code who gets blamed, its also the reviewer of said code.

Analog

sure eMudhra needs to be investigated and confirmed that even a small part of their business hadn't been used to compromise (it doesn't matter that they left the business, it matters that the investigation continues)

but also we need to see how it is this even happened, who dropped the ball and approved the bad code/behavior to enter in the first place??

or is this a structural issue where we need to introduce more checks/balances (tests)

Smart business decision to have made 10 years ago. Thanks for the mess.

Kinda funny that logo says "Trust Delivered". They don't seem to have 0 problem with such a big scale damage on public internet and simply trying to shrug off the problem.

This is problem with Indian companies, their founder and management always try to hire cheap labor and penny pinch on everything. And, this is the result we see again and again.

Let's be real - there was no way for them to recover their way out of that after this ridiculously bad screw-up.

Good riddance, they should also pay a fine for subjecting us to their incompetence.

Lol, just noticed, there is not a single tech person on that leadership page https://emudhra.com/en/leadership

Do they accept invoices for patching their security flaws?

Are they liable?

honestly, props to the c-suite to have enough awareness that this buisness was already dead for them and there was absolutely no pathway where they are getting their certificates trusted in PKI ever again.

this lets them exit this without public humiliation of getting made fun (and example of) in the mailing lists.

Nevermind the legal liabilities, how is their company viable with this sort of brand damage? Their other business lines aren't making toasters. It's the same line of work. They sell trust.

Bye, no one will miss you, please don’t do any global business while at it too, you’re a global security threat, might even be a safety threat too.

There must be criminal matter here.

Typical bullshit where India regulations force people in India to buy local - and because the landscape is filled with incompetent and inept companies you get shit like this.

Why was anyone using certificates from a little known company with no cybersecurity muscle?

yea sure, blame social media cause you are incompetent. nice

Oh dear, never mind.

"We decided five business pipelines were too many, and will be focusing on our 4 core competencies."

~ Not a quote from the press release

I'm still waiting to read their post mortem with their ~~5~~ 4 Whys

The izzat must be protected at all cost!

Terrible company, such evasive statements. Seems ripe for disruption.

Surely they should be investigated by the local regulator.

At this point, they probably asked Claude or another chatbot how to change the root CA key and realized that is was too late.

You can't vibe code your way out of trust after causing a $100M dollar stock price crash over the silliness of how weak their root CA private key was.

Once you make a mistake like that, you're basically gone four ever

probably a good career move

When is Sectigo, the root CA that cross-signed the vulnerable intermediate CAs, going to take responsibility for fucking up too? Why should we keep trusting them?

Disgusting. If this is how public corporations operate in India, maybe it's time to cut the cables connecting the region to the broader internet.

Laughable entity. Good!

"Trust Delivered". Eh..

Can we finally have DANE support in browsers now?

"You can't fire me, I quit!"

[dead]

[flagged]

[dead]

[dead]

now the question for the media for the next week :

ban LLM discovery of horrendous security practices because as it turns out security-thru-obscurity is being practiced as 'good enough' across the world , or actually enforce realistic and livable security practice ?

given the insistence on picking overblown and totally partisan poor choices lately, I presume the media will sit on the side of 'we'll just ban LLMs from checking the rest of our security apparatus for single digit keys' and charge 'Wayne' with terrorism statutes.' -- but hopefully i'm just being a jaded pessimist.

Everybody laughed when they said GPT-2 wasn’t safe to release. This is the tip of the iceberg.