HN Explorer

eMudhra to Exit Global SSL/TLS Certificate Business;

5 points by parimm ↗ HN
Press Release titled “eMudhra to Exit global SSL/TLS Certificate Business; Will Sharpen Focus on Core Enterprise Solutions and trust services other than SSL/TLS”

https://www.bseindia.com/xml-data/corpfiling/AttachLive/82503e00-335c-49dc-b022-f4633a08b642.pdf

61 comments

[ 0.40 ms ] story [ 8.0 ms ] thread
solatic
"will sharpen focus on... trust services other than SSL/TLS"

Is there some reputation left to salvage here that I'm not aware of? Who would trust them?

ahartmetz
If they wanted to continue to make money, they could: exit the business, wait a bit, change the company name, and re-enter the business. Where "change the company name" could mean starting an actual new company, but with the same people, offices, contacts (OK, small problem there) and so on.
ygouzerh
They will probably change their name soon
gumby
They probably have cash in the bank and want to try to put it into something that might make money. An extreme pivot.
jerf
"You can't fire me, I quit!"
gamegod
This press release was brought to you by the number 4
ieie3366
Related: the absolutely brutal question battery the Chrome team publicly submitted to eMudhra

https://bugzilla.mozilla.org/show_bug.cgi?id=2083449#c30

hmokiguess
Why brutal? Reads very reasonable to me, nothing personal and nothing about someone or feelings everything about the entity and its obligations.
wolrah
As Wayne points out later in the thread, it's because those who are paying attention already know the answers but the questions are specifically designed to both confirm that eMudhra actually understands what they've done wrong and are willing to publicly acknowledge it, which is a critical factor in how an incident will affect trust going forward.

Obviously in this case eMudhra has decided they don't want the responsibility anymore which I actually respect to some extent.

Phileosopher
It's brutal the way reading lawyer interrogatory questions is brutal. Facts, details, and specific data that hold people accountable. The language is also in legitimate government probes and incident response reports.

I'd like to say it's how journalism works as well, but that ship sailed decades ago.

kbar13
oof. even as a bystander i’m feeling the cortisol just reading the questions. i’m curious what even goes into compiling this list of questions - did they plan on going for the kill?
antonvs
They planned on expecting a reasonable level of competence.

There’s no excusing this. This is a company that specializes in “digital trust”. Even if they exit the TLS CA cert business, would you want to rely on them for the “post-quantum cryptography” prominently featured on their homepage?

This is a case where it would actually make sense for a government to come in and shut them down. There’s no reasonable scenario in which this is a company that anyone should use for “digital trust”, and any customers dumb enough to do that might literally need to be protected from themselves, for everyone’s benefit.

You wouldn’t have to twist my arm very hard to convince me that any customers that continue to use them after this incident should also be shut down.

creatonez
The intent isn't public shaming, it's to have enough information about what the hell happened, so that the failure mode can be squashed as thoroughly as possible in the future. Other CAs and interested parties should be terrified about the possibility that they have the same cockroach infestation as a result of using the same software or similar procedures, rather than be sneering about how bad the so-called "human error" was this time.
apexalpha
Offtopic: collapsing comments with a flair like ‘off topic’ or ‘me too’ is a great idea and really adds to keep the discussion on track.

This was a good read on the situation, thanks for the link.

Is the Mozilla bugtracker usually a / the Go to party for these issues? Or just a coincidence in this case?

wolrah
> Is the Mozilla bugtracker usually a / the Go to party for these issues? Or just a coincidence in this case?

Yes, because of the project's open nature the Mozilla CA program Bugzilla and their dev-security-policy mailing list have become the de facto public discussion point for TLS-related issues.

nxobject
Luckily enough, they now have no reason to answer these questions and keep shtum forever…
jesuswasjew
CA Forum, Apple, Google and Mozilla are to be blamed for just giving license to random no security background far away company.
geodel
Not to give into conspiracy theories but this company might be ideologically even if not materially aligned to current regime in India. With right kind of nudge any kind business contract is possible without any competency.
wannabe44
You seem to have an axe against current Indian regime which is not even outside the overton window. I suggest to not get your information from liberal-arts educated islamophile journalists who are struggling to pay off their loans.
traceroute66
Yes, its all very well someone here shouting about "the absolutely brutal question battery the Chrome team publicly submitted to eMudhra".

But in all honesty there are serious questions to be asked about:

a) The initial approval process for ANY CA

b) The ongoing monitoring process for ANY CA

The fact this CA was based in India ultimately has nothing to do with it if we are being completely honest here.

Clearly there is a fundamental problem with the overarching approval and monitoring process which means it could have happened anywhere. This time it just happened to be India.

Secondly, in direct reference to the "far away company" comment India does have quite strict controls on both certain technical things (speaking generally here, not specifically in relation to certs ... e.g. use of sat phones). And in general it is quite difficult (read: almost impossible) to turn up in India and do business as an external company. So there is probably a genuine need for an Indian company CA since not every body can/wants to use Let's Encrypt or whatever.

xbar
CA approvals are bad. From 2000 to 2015, I ran an org where we allow-listed a modest subset of the the CAs that were approved by Google, Microsoft, and Mozilla. There were too many incidents and bad actors.

Microsoft, in particular, had strong transparency around CA approval processes that were reasonable. It was weird.

cromka
> Far away company

Far away from it the default country?

[deleted]
(comment deleted)
eudamoniac
Far away from the nearest technologically competent country where this would not happen
tredre3
That country you describe doesn't exist.
eudamoniac
The only time anything like this has ever happened was in Malaysia and now India, so...
cromka
So you have a sample of... two? Please do share the conclusions you drew from this.
eudamoniac
Look we can just stop pretending that India isn't largely technically incompetent. We've all worked with offshore devs. Let's just be honest on the internet and stop pretending not to understand things.
crossroadsguy
> Look we can just stop pretending that India isn't largely technically incompetent

Or we can just stop pretending that no one in this sub-thread is a racist.

> Let's just be honest on the internet and stop pretending not to understand things.

Yeah, let's do that. You wanna start? Come on now. Go on.

eudamoniac
Buddy... It's purely economic factors. You are attributing malice to me.
wannabe44
The charitable interpretation is a company whose operations they have no idea about due to distance.
crossroadsguy
The only true country. Land of the free. Gaad's country. (Mallu mates, it's different from God's country, fret not).
account42
Yes. Absolutely.

Signed, someone not from the default country.

zerozerotwo
As a reminder Mozilla was warned not to add the Chinese government as a ca they pushed back claiming lack of evidence and only removed them as a ca once cnnic got caught issuing certs for google domains (by accident )
notSavonarola
I have four (4) takes on the matter.
FinnKuhn
If anyone else also struggles to understand all the "4" references in the comments: One of their private keys was "4", with others also being in the 2-3 digit range.

Apparently they generated them like this: https://xkcd.com/221/

vlfig
There must be criminal matter here.
geodel
Maybe. But not in place where this company resides and does business with the government.
[deleted]
(comment deleted)
malfist
I'm still waiting to read their post mortem with their ~~5~~ 4 Whys
AdvitXSingh
yea sure, blame social media cause you are incompetent. nice
sambull
I think this opens bigger questions on who and how people get access to these capabilities. After that recent cold wallet physical supply chain take over, what sort of people are able to get certs for anything they need?
xbar
Smart business decision to have made 10 years ago. Thanks for the mess.