--- title: "Who Is Watching the Internet's Gatekeepers?" description: "When the organisations responsible for internet security fail, who holds them accountable?" author: "Erwin Groen" date: 2026-11-01 image: "media/who-is-watching-the-internets-gatekeepers.png" tags: - OwnTheDot - Digital Trust - Internet Security - Certificate Authorities - Handshake --- We're constantly reminded to protect our passwords, secure our accounts and take responsibility for our safety online. But what happens when the organisations we rely on to keep the internet secure fail to meet those same standards? In October 2026, researchers discovered eight dangerously weak private keys belonging to eMudhra, a company trusted to help verify the identity of websites and software. These weren't ordinary passwords. They were security keys associated with digital certificates that could potentially be misused to impersonate websites or sign software. Some of those private keys were simply the numbers **4, 56, 66 and 115**. That's how weak they were. ## Almost Eighteen Months Without Detection The affected keys were created in April 2025. Their weakness wasn't publicly exposed until October 2026, around eighteen months later. During that time, the certificate authority had undergone independent security audits. Yet the weakness went undetected. Security researcher Scott Helme demonstrated how easily the keys could be recovered, raising serious questions about the checks that should have caught the problem. Google and Mozilla moved quickly to block the affected certificates. But why did it take an independent researcher to expose a weakness that had existed for so long? ## When Trust Becomes a Vulnerability On 30 October, Cloudflare published additional findings. Its network had recorded approximately **22,000 TLS connection attempts** involving the affected keys, including suspicious certificate activity. That doesn't establish that attackers successfully compromised users, but it demonstrates why the weakness couldn't simply be dismissed as theoretical. Cloudflare also found that some older browsers and embedded systems continued accepting affected certificates after major browser providers had introduced protections. Microsoft issued updates to remove affected certificates from its trusted systems. Meanwhile, eMudhra announced that it was withdrawing from the global website certificate business and appointing KPMG to conduct an independent investigation. The consequences extended well beyond eight weak keys. ## Who Checks the Gatekeepers? Most internet users have never heard of the certificate authorities their browsers rely upon. Yet these organisations play a major role in determining which website connections our devices can trust. They're subject to technical standards, security requirements and independent audits. Those safeguards exist for good reasons. But when such a fundamental weakness survives for almost eighteen months, we have to question how effective that oversight really is. And when a trusted authority is compromised, there's another problem. Removing trust from modern browsers doesn't necessarily remove it from every older device, application or connected system. **The certificate may be revoked, but the trust can linger.** ## Owning Your Name Isn't the Same as Controlling Your Trust In my earlier article, [Who Decides Which Websites We Can Trust?](https://ownthedot.com/articles/who-decides-which-websites-we-can-trust), I explored how browsers decide which website connections to trust. At OwnTheDot, I've repeatedly questioned who controls our digital names and who makes the rules governing them. Handshake offers an alternative approach to internet naming, allowing individuals to control top level names through cryptographic keys. It doesn't automatically solve problems involving HTTPS certificates. You might control your domain name. You might operate your own website. Yet your browser still relies on security decisions made by organisations you may never have heard of. Those decisions can affect whether your connection is accepted, rejected or considered trustworthy. Digital independence isn't just about who controls a name. It's also about understanding the systems we depend upon to use it. ## Who Answers When They Fail? Google, Mozilla and Microsoft acted to protect users. eMudhra has acknowledged the incident, taken action and commissioned an independent investigation. Those responses matter. But so does understanding why the existing safeguards failed. If individuals are expected to take responsibility for their online security, we should demand at least as much accountability from the organisations entrusted with protecting it. **We can revoke a certificate. We can remove a trusted authority. But how do we ensure that the trust we've withdrawn is no longer being granted elsewhere?** **Own the Name | Own the Rules | Own The Dot.** --- ### Sources - [Google — Protecting Chrome and Android users](https://blog.google/security/protecting-chrome-and-android-users-from-compromised-emudhra-intermediate-ca-certificates/) - [Mozilla — Response to the eMudhra incident](https://blog.mozilla.org/security/2026/10/20/protecting-firefox-users-following-the-compromise-of-emudhra-intermediate-certificates/) - [Cloudflare — Tracking exploitation and patching](https://blog.cloudflare.com/emudhra-patching/) - [Microsoft — Response to compromised eMudhra keys](https://www.microsoft.com/en-us/msrc/blog/2026/10/microsoft-response-to-compromised-emudhra-certificate-authority-keys) - [Mozilla — Public incident investigation](https://bugzilla.mozilla.org/show_bug.cgi?id=2083449)