Trust on the internet is supposed to be one of the marvels of modern cryptography. A malicious website may try to impersonate your bank or email provider, but web browsers are designed to block the fake. The encryption behind the padlock in the address bar is so strong that even supercomputers running for millennia wouldn’t be able to break it.

That, at least, is the theory. Recent news brought a grim reminder to the global tech community that the system is only as strong as the institutions we trust to police it.

Browsers such as Chrome, Safari and Firefox don’t independently verify every website on Earth. Instead, they outsource that power to a few dozen commercial and government-linked entities known as Certificate Authorities. They are the internet’s notaries. But what happens when the guarantor can’t be trusted?

On Oct. 21, Bengaluru-based eMudhra, the only such certification authority from India, gave the internet a collective panic attack. The firm disclosed that eight of its private keys — digital codes so foundational to online security that they are supposed to be created inside secure, offline chips under tightly controlled conditions and never seen by human eyes — were laughably easy to guess.

In fact, one of them was four. Not a four-digit code. Simply the number 4.

Worse, these compromised credentials had made their way into systems trusted by Big........

© The Japan Times