121–130 of 318 posts
Earlier quoted context omitted.
Which is the whole value proposition of a CA. Without this, a website and its clients are vulnerable to MitM attacks.
But not vulnerable to passive wholesale eavesdropping that the NSA and likely other worldwide spies agencies have been doing.
Earlier quoted context omitted.
Let's Encrypt is also limited in that it issues Domain Validated certificates only. They aren't planning on issuing EV certificates (the "green address bar").
EV certs are a total waste of money. Pretty much everyone except maybe the site administrator won't notice and won't consider it a problem when a lock icon is shown instead of a green bar.
I don't know if it's worth the money per se, but you can pin a couple of trusted CA root EV certs via HPKP and know it's much more difficult for someone to "accidentally" issue a valid cert for your site.
If you do that, users won't see a lock instead of a green bar, they'll be blocked from accessing the site at all (if it's not their first visit and they're using a modern browser).
Earlier quoted context omitted.
Not yet, because Let's Encrypt doesn't provide wildcard certificates as of now. This may change in the near future, though. Also note that free single domain certificates have been available from StartSSL for a very long time, but this didn't destroy the certificate industry.
An argument can be made that Let's Encrypt doesn't need wildcard certificates since new certs can be generated automatically every time a subdomain is added.
[1] https://sandstorm.io [2] https://docs.sandstorm.io/en/latest/using/security-practices...
See a Let's Encrypt cert in action: https://helloworld.letsencrypt.org/ Nice work team!
I was unable to connect using a vendor-specific browser on an old Android 4 device. Is this a limitation of the LE cert, or a cipher suite issue with older browsers, or something else? Really looking forward to spreading HTTPS far and wide.
Earlier quoted context omitted.
True! But wildcards make cert management so much easier . If I have a handful of subdomains, that's fine. If I have thousands, I want a wildcard cert.
It would be relatively easy to write a simple bash script to automate it. Granted, it might take a bit of time to generate a few thousand certs, but it wouldn't take more than a day if you only have a thousand or so.
And from the client perspective is makes pinning much easier.
I'm not a fan of one-wildcard-to-rule-them either but keeping active certs to a handful through the judicious use of wildcards is a real boon.
Earlier quoted context omitted.
This is absolutely FUD, even if you don't intend it to be. By what mechanism do you suppose the TLA boogeymen could compel ISRG to give up their private keys, and how would a team of lawyers make one exempt from such mechanisms? Let's Encrypt is the effort of a benefit corp (ISRG) run by people who care about security and privacy enough to bake it into the foundations of the organization [1]. I think this makes them…
By EXACTLY the same means as last time[1]. Lavabit waa ordered to give up their private key, despite the fact that Lavabit wasn't, itself, under investigation. In other words, they were forced to give up their clients privacy and were given a gag orders. Attorneys don't exempt anyone from anything, but your comment seems to suggest their existence is for entertainment. A team of attorneys might have found a way out o…
This reasoning would not apply to CA's.
But this is kind of a good thing, because after enough attacks on the old model, people will ask for an improvement or replacement of the model.
Earlier quoted context omitted.
They are not quite the same thing: * CloudFlare doesn't give you a certificate. It terminates your TLS connection at their endpoint with a certificate they own the private key to. * StartSSL free tier is for non-commerical use only. * Haven't used WoSign so no idea what it is, but clicking on the link took was so laggy it didn't give me much confidence. (I personally wouldn't work with a company in China jurisdiction…
> user-friendly This is the key. StartSSL is NOT user-friendly at all, even if you want to use it for the non-commercial personal use that it was designed for.
Being told that you now trust someone with your secrets via a news website is a pleasingly succinct display of everything that's wrong with the CA model.
We’re pleased to announce that we’ve received cross-signatures from IdenTrust This is what is wrong with the CA, model, not their method of announcing it to a community anxiously awaiting the arrival of their product. What is absurd is that identrust has a shitty non-responsive 90's looking website and wants $299 for an SSL certificate, which is something that should be free. I will say though, they really did sell m…