Being told that you now trust someone with your secrets via a news website is a pleasingly succinct display of everything that's wrong with the CA model.
Let's Encrypt is Trusted
81–90 of 318 posts
Re: Let's Encrypt is Trusted
#82Could somebody clarify: LetsEncrypt allows anybody to create certificate for any domain, so would not that allow anybody to create MITM certificate for any such domain?
Look at the tech overview: https://letsencrypt.org/howitworks/technology/ You can only obtain a certificate for a domain if you can validate that you control the domain. Their steps for that (place arbitrary content at an arbitrary URL they request, or create an arbitrary DNS record they request) are such that, if you weren't the legitimate controller of the domain but could do those things, you wouldn't need a fake…
If a site has tons of https links leading to it, or uses HSTS, then MITMing it without a cert would not be useful. So you MITM it with Let's Encrypt, and they will give you a cert and you just increased your attack capabilities by leveraging Let's Encrypt.
This isn't really a failing on Let's Encrypt though, because tons of other CAs issue certs by only verifying this exact same stuff. Certs are only as secure as the least secure CA. Since the security was already this weak, Let's Encrypt has not made it any weaker.
Re: Let's Encrypt is Trusted
#83Earlier quoted context omitted.
The client is written in Python, and the parent comment is ranting about it. https://github.com/letsencrypt/letsencrypt
I really tried not to make it a rant. Sorry if it came off that way. Just seems like they made some unfortunate sacrifices to keep it as a python application (like Windows support).
There is an MSI to install Python on windows.
Re: Let's Encrypt is Trusted
#84"We’re pleased to announce that we’ve received cross-signatures from IdenTrust" How is this beneficial for IdenTrust?
Related discussion: https://community.letsencrypt.org/t/what-is-the-business-mod... It establishes IdenTrust as a more influential leader of SSL certificates on the Web. There are other ways CAs can make money, and this extra publicity will probably serve them well.
IdenTrust is an interesting organization. IdenTrust is a bank consortium acting as a public key certificate authority and secure applications provider whose members include over 60 of the largest banks in the world. John Sculley has been IdenTrust's chairman since 2006.
Re: Let's Encrypt is Trusted
#85Wow that's great.
I signed up for the beta months ago, but I still don't have a 'free' certificate.
Who the fuck are these guys?
Re: Let's Encrypt is Trusted
#86Earlier quoted context omitted.
Look at the tech overview: https://letsencrypt.org/howitworks/technology/ You can only obtain a certificate for a domain if you can validate that you control the domain. Their steps for that (place arbitrary content at an arbitrary URL they request, or create an arbitrary DNS record they request) are such that, if you weren't the legitimate controller of the domain but could do those things, you wouldn't need a fake…
> You can only obtain a certificate for a domain if you can validate that you control the domain. Technically, you only have to make their systems think you control the domain. If their servers or 'establish proof of ownership' process are hacked, wouldn't this allow an attacker to do the same thing that happened in the DigiNotar hack? https://en.wikipedia.org/wiki/DigiNotar
Again we're in the realm of "if you could do that, you already could MITM or do other malicious stuff in a dozen other ways".
So, sure. If you can hack a trusted CA, you can do bad things. That was true before.
Re: Let's Encrypt is Trusted
#87Can anyone who knows more than me say - is this the beginning of the end of the SSL cert selling business? Is there still value to buying an expensive cert from another vendor?
> Is there still value to buying an expensive cert from another vendor?
If you are running a commercial, high-traffic website, then yes, there is.
For example, EV (extended validation) certificates is currently the only way to quickly build and maintain a "reputation" with 3rd party website ranking systems such as Microsoft's SmartScreen and, based on anecdotal evidence, with Symantec SafeWeb and Google SafeBrowsing services. Needless to say that SmartScreen is on by default in IE/Edge and SafeBrowsing is on in Chrome and, in part, Firefox.
Re: Let's Encrypt is Trusted
#88Being told that you now trust someone with your secrets via a news website is a pleasingly succinct display of everything that's wrong with the CA model.
We’re pleased to announce that we’ve received cross-signatures from IdenTrust
This is what is wrong with the CA, model, not their method of announcing it to a community anxiously awaiting the arrival of their product. What is absurd is that identrust has a shitty non-responsive 90's looking website and wants $299 for an SSL certificate, which is something that should be free. I will say though, they really did sell me on their trust worthiness with the alternating images of a fingerprint and a lock. So now I know they're legit. It is worth the $99 for SSL on a single site annually because there is binary data superimposed on some of the pictures.
Re: Let's Encrypt is Trusted
#89Congratulations jdkasten!
Re: Let's Encrypt is Trusted
#90Earlier quoted context omitted.
An argument can be made that Let's Encrypt doesn't need wildcard certificates since new certs can be generated automatically every time a subdomain is added.
True! But wildcards make cert management so much easier . If I have a handful of subdomains, that's fine. If I have thousands, I want a wildcard cert.
It would be relatively easy to write a simple bash script to automate it. Granted, it might take a bit of time to generate a few thousand certs, but it wouldn't take more than a day if you only have a thousand or so.