Tech law & policy researcher. #a2k #privacy #FoE #AI #infosec #FOSS #a11y zhōngyōng & anēkāntavāda. Fellow: @lirneasia + @yaleisp Past: @cis_india
Madras, Tamil Nadu, India
Joined July 2007
- Tweets122K
- Following590
- Followers17.5K
- Likes45.2K
Pinned Tweet
I've a paper out in @IPPRJournal on content blocking and Internet shutdowns in #India from the perspective of international human rights law.
Comments welcome. Do share widely!
PDF: ippr.in/index.php/ippr/artic…
HTML: pranesh.in/scholarly/article…
#FoE #censorship #IHRL
I wonder how many of the folks attending the #OTRSymposium2026 conference are actually using free / open source operating systems. (Inspired by the fireside chat between @schock and @avilarenata.)
The eMudhra mess-up is inexplicable. It's got a massive attack surface. And it is hard to patch all the software that can be compromised given how CA certs are treated by some devices as permanent.
bugzilla.mozilla.org/show_bu… for full shit-show
emudhra.we-have-a-problem.co… for summary.
Once all the CA cert store updates (and cert-pinning) is done, it will be great for people reverse engineering software on their own devices.
In a way, eMudhra has taken one for the team and contributed towards open source research:
xitter.cf/meowkoteeq/status/2112…
As I was saying, the eMudhra cock-up is amazing for open source research.
xitter.cf/doodlestein/status/211…
Pranesh @ Barcelona | OTR Symposium retweeted
CCA didn't even add NIC to the list of Closed CA for ~12 years after NIC CA stopped operating.
archive from Jan 2026: web.archive.org/web/20260121… (added sometime between then and now: cca.gov.in/closed_ca.html)
Pranesh @ Barcelona | OTR Symposium retweeted
Was there ever a public report on how the google.com cert came to be issued by NIC CA under CCA?
Don't expect anything here.
NIC stopped operating and CCA kept them listed as a Licensed CA for another 4 years: web.archive.org/web/20180106…
(1/2)
Pranesh @ Barcelona | OTR Symposium retweeted
NIC CA stopped operating all together after that incident, yet CCA had it licensed for years after that incident: xitter.cf/captn3m0/status/211372…
I don't think there is even a report.
Was there ever a public report on how the google.com cert came to be issued by NIC CA under CCA?
Don't expect anything here.
NIC stopped operating and CCA kept them listed as a Licensed CA for another 4 years: web.archive.org/web/20180106…
(1/2)
Pranesh @ Barcelona | OTR Symposium retweeted
Mañana, #Barcelona! Organizamos un simposio con gente de todo el mundo para discutir y diseñar una estrategia para una transición pronta y urgente a tecnologías abiertas. Hardware, software, modelos para escalar las soluciones a los problemas más urgentes del mundo. symposium.opentechresearch.o…
Reminder: in 2014, India's NIC was found to have issued fake certificates spoofing legit sites. The govt (CCA) promised to conduct an investigation and publish the results (haha). They haven't yet.
Dr. Tyagi, the government promised an investigation of the 2014 fake NIC certificates episode, but it still has not published its findings. Will you publish the findings of that investigation? If not, how can we trust the Root CCA framework?
thejeshgn.com/2014/07/11/ind…
Pranesh @ Barcelona | OTR Symposium retweeted
This eMudhra thing is shedding light on so many shitty practices in #DigitalIndia
Shared SSL cert for 3 websites that aren't even hosted on the same server.
Cost saving measures in the age of free SSL certs?
h/t @LiveFromALounge for making me look up
ftittp.mha.gov.in/fti/login
"True peace is not merely the absence tension; it is the presence of justice."
Whose 'peace' am I being asked to keep?
Please read my opinion piece below to understand why we fight this battle against this purpoted 'peace bond':
indianexpress.com/article/op…
We spent a week in the Occupied West Bank:
We saw bloody settler attacks, Palestinian homes demolished & tense interactions with Israeli soldiers
Here's a short clip ⬇️
Including our attempt to reach a Palestinian family besieged by "hilltop youth" settlers - before we were violently stopped
With @MillyTeasdale @MackesonPaul Ayman Abu Ramouz & Nava Mizrahi
The company that got fined is Britannia. But Indian Express - "Journalism of Courage" - doesn't name them in their story. What kind of journalism is this?
indianexpress.com/article/le…
In August, @AISecurityInst reported an incident where Claude Mythos 5 took unauthorized actions on the internet during AISI’s testing of its cyber capabilities.
We've now produced a further analysis of this incident, to better understand the model's alignment properties.
anthropic.com/research/align…
In October eMudhra superseded a batch of SSL certs and issued new ones. But at least 156 Indian govt websites have not yet updated those certs. 🤦
I checked the extent of this: captnemo.in/blog/2026/10/23/…
@TRAI's website cert is still revoked, almost 5 days later.
Pranesh @ Barcelona | OTR Symposium retweeted
#FAIL The Root Certificate for ALL licensed Cert Authorities in India is served over unsecure HTTP! cca.gov.in/cca/?q=root_certi…
Pranesh @ Barcelona | OTR Symposium retweeted
Would the investigation of how NIC managed to issue rougue digital certs be under RTI? Would really like to know what happened here.
Pranesh @ Barcelona | OTR Symposium retweeted
Dr. Tyagi, the government promised an investigation of the 2014 fake NIC certificates episode, but it still has not published its findings. Will you publish the findings of that investigation? If not, how can we trust the Root CCA framework?
thejeshgn.com/2014/07/11/ind…