Making Tech Headlines · Page 4
eMudhra Leaves TLS After Weak Credentials Debacle
· New York time
Certificate authority eMudhra is leaving the TLS business after issuing eight intermediate credentials so weak that anyone could mint certificates for any website or mail server, Ars Technica reported. One had a private encryption key of just 4. That is the number 4, not a four-character password. The failure involved a flawed key-signing ceremony, a process whose ceremonial name did not supply the missing security. Because TLS credentials help establish trust online, the ability to create unauthorized certificates has implications far beyond one company's customer list. Chairman V. Srinivasan cited rising compliance costs and complexity, along with a business that generated just 1 percent of company revenue. He also pointed to free TLS certificate providers reducing returns compared with other products and services. Those are the company's stated business reasons for withdrawing after the incident. The contrast is uncomfortable: a small revenue line can still carry substantial responsibility for other people's trust. Internet security does not scale its expectations down to match a vendor's sales mix. A key-signing ceremony should ideally produce something more resistant to guessing than a number a preschooler might offer before reaching the middle of one hand.
Read this story in the full newspaper →Satire. Not factual reporting. Read the original reporting from the linked publishers.