181–190 of 318 posts
Earlier quoted context omitted.
> it took me just a couple of hours > to learn how the process is handled at StartSSL. Well, if something takes 'just a couple of hours' to learn i'll happily fork over some money to ease the pain. You can get certificates for $10/year nowadays.
"You can get certificates for $10/year nowadays." As a service to the community, could you name some places where you can do that?
Earlier quoted context omitted.
> They provide docker packaging. So it's just as dep-free as Go. ...except needing docker and everything running it in a docker container entails over a simple CLI. Also, it looks like they say "for god's sake don't pip install": Please do not use python setup.py install or ``sudo pip install`. Those mode of operation might corrupt your operating system and is not supported by the Let’s Encrypt team! https://letsencr…
> ....except Windows? Which also doesn't support docker. So the actual problem you have is that you selected an operating system that has zero native support for interpreted languages, and you're mad that they didn't cater their software to you?
(Seriously, though, VBscript, JScript and VBA are natively supported through WSH on Windows)
Earlier quoted context omitted.
> Is there still value to buying an expensive cert from another vendor? If you are running a commercial, high-traffic website, then yes, there is. For example, EV (extended validation) certificates is currently the only way to quickly build and maintain a "reputation" with 3rd party website ranking systems such as Microsoft's SmartScreen and, based on anecdotal evidence, with Symantec SafeWeb and Google SafeBrowsing…
Do you have any recommendations on which CA is good for EV certs (that work in Chrome)?
I run https://certsimple.com. We only do EV certificates, and we do it much faster than any of the existing companies, which normally quote 7-10 days to complete the validation process. I waited around a month for GoDaddy earlier this year, which is how I ended up making CertSimple.
CertSimple do EV certificates in an average of 5 hours.
- We check the customers info against the required government information sources (as well as a number of other places) before customers pay us.
- After we take the order, we provide a specific set of instructions based on a number of characteristics of the customer's actual business to make the validation process as fast as possible.
- We have a real focus on UX: there's no software to install or command line questions, our validation UI updates live, and we manually follow up with every customer to iterate our product.
I'm mike@certsimple.com, or @mikemaccana on Twitter.
Earlier quoted context omitted.
An argument can be made that Let's Encrypt doesn't need wildcard certificates since new certs can be generated automatically every time a subdomain is added.
An interesting usecase of wildcard certs: when I do not want to publish the hostnames I am using. Sandstorm[1] uses unpredictable hostnames as one mitigation against various cross-origin attacks -- if the attacker doesn't know the domain of the app, he can't try to use XSRF against it[2]. [1] https://sandstorm.io [2] https://docs.sandstorm.io/en/latest/using/security-practices...
There are a few existing Nginx configs for that (search for "nginx dynamic ssl cert").
This way, Let's Encrypt in particular would need to be breached for a successful attack, while right now it's enough to breach either Let's Encrypt or any other CA.
Can anyone who knows more than me say - is this the beginning of the end of the SSL cert selling business? Is there still value to buying an expensive cert from another vendor?
Let's Encrypt is also limited in that it issues Domain Validated certificates only. They aren't planning on issuing EV certificates (the "green address bar").
Do you really know the difference between Citi Bank and Citibank? No? Then EV hasn't saved you from being phished.
Is there an easy way to pull out the cert and load it into an AWS ELB without running the client on the server it will eventually protect? I'm not a big fan of using software that auto changes my config files, plus you can't actually run scripts on ELBs.
Earlier quoted context omitted.
If I know Let's Encrypt's secrets, and I control your network, I can set up a valid certificate on my server and MitM you.
... as could any other CA your browser trusts. What makes Let's Encrypt any worse?
All this because a couple of theorists in the 1990s decided that security requires authenticity, despite decades of research to the contrary.
There are all kinds of ways to establish authenticity of counterparties. Entire books are written about that. There are much better ways than our current CA model. But we don't need any of them to have passively secure transport, over which we can then negotiate authenticity.
This is arranging deck chairs on the Hindenburg. It's nice that people will (once they finally get around to issuing certs "in mid-2015") be able to have zero-cost certs, but it doesn't change the fundamental broken-ness and wrong-headedness of having CAs in the first place.
I truly appreciate the hard work Let's Encrypt is doing. However, this is not free. In return for getting an SSL certificate, your users will need to trust an organization to protect the secrets they share with you and vice versa. This organization has no economic incentive to do good for you or to do harm to you. What happens when this organization is compelled by the TLA to give up the lucky charms, and there is no…
I personally argued with the W3C TAG against an HTTPS-only web for this reason. Tim Berners Lee, who heads the TAG, ceremonially speaking, argued against it, too, but on different ground. The browser vendor 'experts' on the TAG totally dismissed any and all argument against forcing everyone to use HTTPS. They were basically told by their employers (the big browser vendors and CDNs like Akamai) to make it happen. HTTP…
Just look at the stupid way browsers treat self-signed certificates: these are strictly better than plaintext, but plaintext gets no warning and self-signed certificates are warned about and in some cases actually blocked.
Similarly, one mailer (exim, I think?) on seeing an untrusted certificate would actually downgrade to plaintext. There aren't enough palms or enough faces for that.