A weak key, a long silence and the case for checking the source
By Karan Bhatty, Founder, Millow
Having spent my career in background verification, I read the eMudhra episode as a verification story first. A report is only as good as the chain behind it. A candidate makes a claim, an issuer confirms it, the screening firm checks the issuer, and the employer relies on the result. The weak link is rarely where people expect it.
Eight keys behind the Bengaluru company’s digital certificates turned out to be tiny numbers, one of them just four. Browsers blocked them within hours of a researcher’s report on October 17. eMudhra says a flaw in a key ceremony script in April 2025 produced the weak keys, and its own filing attributes the lapse to human errors. The company should own that.
What deserves equal attention is how long the keys sat in plain view. Security researcher Ryan Hurst, formerly of Google, writes that they were...
Copyright of this story solely belongs to www.expresscomputer.in. To see the full text click HERE
