Whether you are shopping online or paying your home’s electricity bill, seeing HTTPS in front of the website name often makes you feel that the site is safe. But do you know that despite having HTTPS, a website can be fraudulent? A case related to Indian cyber security company eMudhra has raised questions on the online security system. In this, the private keys of eight digital certificates of the company were found to be very weak. This could create a danger of cheating people by making fake websites appear real.
What is the matter of eMudhra?
eMudhra provides services related to digital signature, online identity and website security. This flaw came to light in eight intermediate certificates related to the company’s global website security business. According to the report, it was very easy to detect the weak private keys associated with them. Digital certificate can be considered as the identity card of the website. With their help, the browser checks the identity of the website and helps in creating a secure connection. But if the private key associated with the certificate is weak, the risk of it being misused increases.
How can online fraud happen?
Suppose, a cyber criminal creates a fake site that looks like your bank or a shopping website. If he can misuse trusted certificates, his website can appear to be genuine. In such a situation, the user may get deceived and share his password, login details or payment information. However, in this case, the potential threat does not mean that such an attack has occurred. According to available information, no evidence has emerged of cyber attacks being carried out using weak keys.
What steps did eMudhra and the government take?
According to the company, the eight affected intermediate certificates were canceled on October 19. Google, Mozilla, Apple and Microsoft were also informed about the matter and steps were taken to block the affected certificates. The Ministry of Electronics and Information Technology (MeitY) has formed a special team for investigation. The Ministry has also clarified that Digital Signature Certificate and eSign services which come under Indian regulation have not been affected. eMudhra has also said that there was no incident of breach in its system or leakage of customer data.
How can online users stay safe?
Do not consider HTTPS or the lock symbol as a complete guarantee of security. Check the website address carefully, avoid clicking on payment links received in unknown messages and do not share OTP or password with anyone. Keep your browser updated and always use the official website or app for banking or payments. Remember, HTTPS helps encrypt the connection, but it doesn’t guarantee that the person running the website is trustworthy.
Also read- 10 year old PHP bug becomes a big threat to websites, AI exposes cyber security
SK Sharma is a content writer who writes on news, entertainment, and lifestyle topics. She has over four years of experience and is known for conveying information in simple and clear language.
