The recent concerns surrounding digital certificate provider eMudhra are not a conventional data breach but a potential challenge to the trust infrastructure that underpins the internet, according to Jiten Jain, Director at Voyager Infosec.
Speaking to NDTV Profit, Jain said the issue should be viewed as a "trust incident" rather than a data leak, as it raises questions about the integrity of the digital certificate ecosystem used to verify the authenticity of websites.
"e-Mudra thing is basically not a data leak. It is more of a trust incident where trust in the entire certification ecosystem looks challenged," Jain said.
Digital certificates act as identity documents for websites, allowing browsers such as Chrome and Firefox to verify that users are connecting to legitimate websites rather than impersonated versions created by cybercriminals. These certificates are issued by trusted authorities such as eMudhra and form the backbone of secure internet communications.
Explaining the issue in simple terms, Jain said concerns have emerged after some certificates issued through intermediaries were found to be using weak cryptographic algorithms. According to him, advances in artificial intelligence and computing capabilities could potentially make it easier to break such weak cryptographic keys, increasing the risk that forged certificates could be created.
If attackers are able to generate forged certificates, they could create fake websites that appear authentic to users and browsers alike. Such websites could mimic popular platforms such as Google or Facebook, making it difficult for users to identify that they are interacting with a fraudulent site.
"Once forged certificates are issued, any attacker can host any fake website looking like Google or Facebook, use that certificate and every user opening the website will actually not be able to distinguish between the real Facebook or Google," Jain said.
The broader concern, he noted, is that internet users rely heavily on browsers and the certificate ecosystem to validate websites. If that trust mechanism is compromised, traditional warning signs become far less effective.
Jain warned that malicious actors could potentially use fake certificates to harvest login credentials, conduct phishing attacks or even trick users into installing malware disguised as legitimate software updates.
Unlike many cybersecurity incidents where users can strengthen passwords or enable additional protections, Jain said ordinary internet users have limited ability to defend themselves against certificate-related threats.
"There is no way a user can distinguish whether the website is real or not," he said, adding that responsibility for maintaining the integrity of the certificate ecosystem lies primarily with certificate authorities and related governing bodies.
While stressing that the issue remains highly technical, Jain offered one practical precaution for users. If a website where they are normally logged in suddenly asks them to re-enter their password, they should exercise additional caution.
He suggested switching from a home or office network to a mobile data connection, or vice versa, and checking whether the service logs in normally. If the site behaves differently across networks, it could indicate that something unusual is occurring.
"This is the basic minimum you can do because in this certificate business, the responsibility is with the certifying authority," Jain said.
The episode highlights how cybersecurity risks increasingly extend beyond data theft and into the digital trust systems that enable secure online interactions, underscoring the critical role played by certificate authorities in maintaining confidence across the internet.
Essential Business Intelligence, Sharp Market Insights, Practical Personal Finance Advice, Daily Fuel, Gold and Silver Prices and Latest Stories — On NDTV Profit.