logoalt Hacker News

rdtsc • today at 2:29 PM • 2 replies • view on HN

> However, the level of social media amplification around this incident has brought scrutiny that is out of proportion to SSL/TLS’s place in our business

Scrutiny is inversely proportional to bit complexity of the private keys they used. Without a failure to apologize or expose how it happened: a human mistake, process mistake, etc. this looks pretty bad on them.

> eMudhra’s global SSL/TLS infrastructure runs separately from its other operations. The company’s Global digital signature certificate (DSC), eSign, and other signing services, including those in India, its enterprise PKI Solutions (emCA, CertiNext platforms), emSigner eSignature Suite, and its identity and authentication solutions (SecurePass, emAS) are not affected and continue to operate as norma

Anyone relying on them with anything related to security or trust is playing Russian roulette at this point.


Replies

pigggg • today at 3:37 PM

Various Indian regulations (particularly around commerce and banking) require you to use India companies for solutions like the above. It gets worse when companies are "steered" by a regulator/compliance person who has a bias for a specific solutions provider.

➕ show 2 replies
cebert • today at 3:50 PM

Right? I don’t know why anybody would trust this company for anything.

➕ show 1 reply