Trust on the internet is supposed to be one of the marvels of modern cryptography. A malicious website may try to impersonate your bank or email provider, but web browsers are designed to block the fake. The encryption behind the padlock in the address bar is so strong that even supercomputers running for millennia wouldn’t be able to break it.
That, at least, is the theory. Last week brought a grim reminder to the global tech community that the system is only as strong as the institutions we trust to police it.
Browsers such as Chrome, Safari, and Firefox don’t independently verify every website on earth. Instead, they outsource that power to a few dozen commercial and government-linked entities known as Certificate Authorities. They are the internet’s notaries. But what happens when the guarantor can’t be trusted?
On Oct. 21, Bengaluru-based eMudhra Ltd., the only such certification authority from India, gave the internet a collective panic attack. The firm disclosed that eight of its private keys — digital codes so foundational to online security that they are supposed to be created inside secure, offline chips under tightly controlled conditions and never seen by human eyes — were laughably easy to guess.
In fact, one of them was four. Not a four-digit code. Simply the number 4.
Worse, these compromised credentials had made their way into systems trusted by Big Tech firms since mid-2025, the company said. They went undetected until an outside researcher deduced the numbers from public data and alerted Apple Inc., Google, Microsoft Corp., and Mozilla Corp. Anyone who hit upon that solution — a feat so basic it hardly required artificial-intelligence tools — would have possessed the digital equivalent of a master passkey, creating counterfeit identities for virtually any website that browsers would accept as genuine.
The more bizarre spectacle, however, came next. With its stock in free fall, eMudhra issued a second statement lamenting that “the level of social media amplification around this incident has brought scrutiny that is out of proportion” to a division accounting for barely 1% of its revenue. The firm said it would voluntarily withdraw from the global web-certification business, stressing that no fraudulent credentials had been minted.
India’s Ministry of Electronics and IT, or MeitY, jumped into the fray with a similar line. While acknowledging the seriousness of the incident and announcing an investigation by a special team, it accused some social-media accounts of fear-mongering. The impact on local websites and applications has been very limited and for a short period, it added.
However, internet security analysts are far from convinced. Browsers have blocked the suspect certificates, but the internet extends far beyond Chrome and Safari. Smart meters, payment terminals, embedded servers, and other connected devices may go years without security updates and may never check whether a certificate has been declared unsafe. That means compromised keys that have been fixed on your phone or computer could remain trusted elsewhere, potentially leaving behind zombie backdoors long after everyone thinks the problem has been solved.
Only a thorough, independent forensic probe would reassure the global software community that this was a blunder, and not deliberate deception. It’s an important distinction because compromised digital notaries have long been used as tools of statecraft and surveillance. DigiNotar BV, a Dutch certificate agency, was hacked in 2011 to target 300,000 Iranian Gmail users in so-called man-in-the-middle attacks. The forged credentials allowed third parties to eavesdrop on — and even alter — conversations between two persons.
New Delhi has firsthand experience of how unforgiving the global browser ecosystem can be. In 2014, Google discovered unauthorized certificates issued for several of its domains by India’s National Informatics Centre, an agency that had also improperly issued credentials for Yahoo. Microsoft, whose registry trusted the authority’s credentials, had to weed them out because users of Internet Explorer and Chrome were potentially exposed. The fallout was severe. Major browsers slapped strict curbs on India and later dropped China’s official internet notary, CNNIC, altogether. The NIC was relegated to signing domestic sovereign domains like gov.in.
The message to eMudhra is the same as it was to the NIC 12 years ago. A business that sells trust can’t afford to run out of its vital raw material. DigiNotar collapsed into bankruptcy within weeks of its breach. Symantec, once a titan of certification, sold its operations after repeated violations of issuance rules.
The prickly reflex from New Delhi is counterproductive. For years, MeitY has pushed a vision of a self-reliant India across local browsers, data hosting, and domestic digital public infrastructure. Indian officials have frequently bristled at their dependence on Western technology, arguing that a nation of 1.4 billion deserves its own. But digital sovereignty can’t be built on indignation. It requires trust. Instead of dismissing the global uproar as overkill, India should insist on complete transparency from what is, after all, a privately owned firm.
Never attribute to malice that which is adequately explained by stupidity. Or so goes the adage known as Hanlon’s razor. But the blade cuts both ways. Fail to provide a convincing account of incompetence, and people will start to look for sinister conspiracies.
That would pose a bigger risk to India’s digital ambitions than eMudhra’s catastrophic cryptography.
This report is auto generated from the Bloomberg news service. ThePrint holds no responsibility for its content.