We need an AI-proof kinder web for idiot humans

 

The wrong file

Picture a room in April 2025. It is a key ceremony. That is the grand name for a small, careful ritual. A few people gather around secure machines. They create the secret numbers that will let millions of browsers trust millions of websites. Everything is witnessed. Everything is logged.

A script runs. It makes the keys. Somewhere inside that script, one step quietly makes a second set. A weaker set. The two sets carry similar labels. Someone, doing their job, picks a file. The wrong one.

Nobody notices. The keys go out into the world. By the middle of 2025 they are in the trust lists of the browsers we all use. For about eighteen months they sit there, vouching.

A private key of this kind should be a random number with more than a hundred digits. One of them was 4. The others were 56, 66, 115, 155, 156, 230 and 237. A child with a calculator could have tried them all before lunch.

On October 17, 2026, a researcher who goes by Wayne noticed. He reported it. Google and Mozilla blocked the certificates that same day. Four days later, eMudhra's shares fell 20%. The company admitted to human errors at multiple steps.

I keep coming back to the person who picked the file. I don't know who they are. I don't want to know. I have been that person. So have you. We have all sent the email to the wrong Rahul. Attached the old version. Hit reply-all. The only difference is the size of the room our mistake walks into.

Built for a smaller world

We evolved in small groups. A mistake hurt a few people. Someone noticed. Someone shouted. The damage stayed local.

The digital world removed every one of those brakes. A key made in one office in Bengaluru could vouch for any website on earth. That is how the system is designed. Anyone holding such a key could forge a certificate for a site they don't own. One tired person. Every bank, every inbox, every government portal.

The sociologist Charles Perrow studied the Three Mile Island nuclear accident and asked why careful people kept producing disasters. His answer was uncomfortable. When a system is complex and its parts are tightly linked, accidents become normal. You can't train them away. The system manufactures them.

James Reason, a psychologist who spent his life studying error, drew it as Swiss cheese. Every layer of defence has holes. Audits, reviews, checklists, sign-offs. Most days the holes don't line up. One day they do. eMudhra says its systems passed independent audits. The holes lined up anyway. They stayed lined up for eighteen months.

Now add the forest. In Liu Cixin's novel The Dark Forest, every civilisation hides, because whoever shows itself gets hunted. The web has become a version of that. The hunters can see us. We can't see them. They need one hole. We need to have none. In that game the prey loses eventually. It is only a question of when.

And the hunters have a new weapon. AI is the perfect bureaucrat. It never sleeps. It reads every log. It writes ten thousand convincing emails in ten thousand voices. It tries every door, every night. It is native to this always-on world in a way we will never be. Pointed at us, it turns our fallibility into a harvest.

So here is the question that kept me up. 
If AI can be weaponised against human incompetence, why can't it be put to work for us? Why can't we rebuild the web for the people who actually use it? Tired. Distracted. Holding an old phone. Picking the wrong file.

There is a precedent. Flying. Early aviation killed people constantly. Over decades, the industry accepted something humbling: every pilot will make mistakes, sooner or later. So it stopped asking for perfect pilots. It built checklists. Two-person cross-checks. Black boxes. Blame-free reporting, so errors come out into the open and get studied. Today flying is the safest way to travel. Pilots are as human as ever. The system around them learned to expect it.

The web never had its aviation moment. It still assumes the person at the key ceremony, the clerk at the bank and the grandmother with the phone will each do their part perfectly. Every time. Forever.

A web for people who slip

So what would it look like to start again, assuming every human will fail at some point? Here are seven ideas. Each already exists somewhere in a small form. That is the hopeful part.

1. Keep every mistake small. Today one certifier can vouch for the whole internet. In a rebuilt web, trust comes in small portions. A certifier vouches only for the names it was set up for. A bank vouches for its own website. When one portion fails, one corner breaks. The rest stands.

2. Let mistakes die on their own. The eMudhra keys lived for eighteen months. Had they expired every two weeks, the error would have healed before anyone found it. Short lifespans also protect the millions who use old Android phones that no longer get updates. A phone that never updates still stops trusting a key once that key expires.

3. Make the wrong move impossible. A microwave won't run with the door open. Toyota's factories call this poka-yoke: design each step so the error physically can't happen. The ceremony software should have refused to sign with a key that small. Two files with similar names should never have been a choice a person had to make. A machine can ask "is this a huge random number?" in a millionth of a second. It never gets bored of asking.

4. Put everything in the light, and let machines watch. The eMudhra certificates were public. That is how a lone outsider could test them and find the flaw. Now extend that. Bank domain registrations. Payment routing rules. Government key ceremonies. Publish them all to logs that can't be quietly edited. Then let cheap AI watchers read them, run by researchers, journalists, rival companies, curious students. One Wayne becomes ten thousand. The dark forest gets lit.

5. Give every person a guardian. A grandmother in Nashik should not need to know what bank.in means. An AI agent on her phone checks every link, sender and payment request against what is normal for her. When a stranger who sounds like her grandson asks for money, it slows her down. It asks her a question. She still decides. The guardian makes the dangerous choice slow and loud.

6. Make undo the default. A UPI payment is final in seconds. That speed is lovely for chai. Fraudsters love it too. A web built for humans holds large or unusual payments in a short window you can cancel. Gmail already lets you unsend an email for a few seconds. Money deserves at least that.

7. Send the bill to whoever can fix it. Today the person with the cheapest phone carries the risk of an expert's mistake. Move that cost to the certifier, the bank and the phone maker. People who pay for failures start engineering against them.

Where this breaks

I should be honest about the cracks.

eMudhra's audits passed. An AI auditor paid by the company it audits will produce the same theatre, only faster. Machines help when the checker gains by finding faults. Bug bounties already work this way: outsiders get paid per flaw they find.

The guardian becomes the new target. An agent that reads web pages can be steered by text hidden inside those pages. Engineers call this prompt injection. So the guardian needs hard limits it cannot be argued out of. It should run on the phone itself, with open code and competing makers. If one company or one government owns everyone's guardian, we have just rebuilt the problem.

And the hunters get AI too. Our advantage is narrow but real. Hunters need darkness. We can take it away.

Four

I keep thinking about the number four.

Nobody chose it. It fell out of a script, slipped past a tired hand, and sat in the foundations of the web for a year and a half. That is what human error looks like at scale. Small. Ordinary. Patient.

We will keep making these mistakes. We are the same animal that forgets where it left the house keys. What we can choose is what we build around ourselves.

For the first time, we have a watcher that never tires. The hunters picked it up first. The question now is whose side we put it on.


Sources

Comments

Popular posts from this blog

The anthem of the deluded

Why I repair my shoe

the god is a waiter.