https://d6cbd428.hugo-blog-e6x.pages.dev/tags/cyber-security/ Recent content in Cyber-Security on Aditya Naik | Personal Website Hugo en Thu, 22 Oct 2026 21:12:52 +0200 https://d6cbd428.hugo-blog-e6x.pages.dev/note/20261022-ca-certs-compromised/ Thu, 22 Oct 2026 21:12:52 +0200 https://d6cbd428.hugo-blog-e6x.pages.dev/note/20261022-ca-certs-compromised/ <p>Today was not a great day for web security on multiple fundamental levels. There was an issue within core layers of TLS and you can read more about it <a href="https://blog.cloudflare.com/emudhra-certificate-compromise" target="_blank" rel="noopener" >on cloudflare blog</a > </p> <p>On the non-technical side, this issue could have been much better handled by both the eMudhra company and indian regulator, but they instead decided to gaslight and claim social media fear mongering. Standard reaction and expected, but disappointing none the less. Interestingly enough, they used very low entropy root keys for their intermediate certificates, but any key is as random as any other key so this looks embarrassing for them to have used test keys in production for more than a year without realizing this process gap. Since then, they have announced that they are moving out of SSL/TLS business but perception damage is done.</p>