Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Let's Encrypt is Trusted

letsencrypt.org

Post reply on HN
Print view View original

261–270 of 318 posts

Re: Let's Encrypt is Trusted

#261

Post by vonklaus »

gopowerranger wrote: post #232
vonklaus wrote: post #88

Earlier quoted context omitted.

We’re pleased to announce that we’ve received cross-signatures from IdenTrust This is what is wrong with the CA, model, not their method of announcing it to a community anxiously awaiting the arrival of their product. What is absurd is that identrust has a shitty non-responsive 90's looking website and wants $299 for an SSL certificate, which is something that should be free. I will say though, they really did sell m…

Nothing you said is a reason for not using Let's Encrypt.

To be clear, I am massively excited to use Let's Encrypt and plan on setting up SSL for the first time ever when it launches. I am legit broke so I can't afford to pay a lot of money for someone to have an automated process of:

    gpg --gen-key
I was responding to parent, that announcing trust is a werid quirk of the CA model. TBH, that is correct, but I find it more bizarre Let's Encrypt has to be "trusted" by an unknown company that no one really knows anything about. That is the bit I find weirdest.

Re: Let's Encrypt is Trusted

#262

Post by jpreiland »

davidcollantes wrote: post #208
ersii wrote: post #162

Earlier quoted context omitted.

I would just like to point out the irony in using 'LE' as a short for Let's Encrypt, as 'LE' usually gets used for shortening Law Enforcement. (Also: Congratulations and well done, Team Let's Encrypt!)

"LE" is identified more with "Limited Edition," I think. At least in the US.

I always associate "LE" with "Lawful Evil", but maybe I'm a nerd

Re: Let's Encrypt is Trusted

#263

Post by vinay_ys »

In a mobile only world where your critical business runs only via mobile app do CA based SSLs even matter? Why not use your own CA with your own certificates and don't have to trust any CA?

Re: Let's Encrypt is Trusted

#264

Post by jsprogrammer »

jrochkind1 wrote: post #254
Pyxl101 wrote: post #49

Earlier quoted context omitted.

What is the rationale for treating wildcard certificates differently? That is, why can't Let's Encrypt issue them?

Well, Let's Encrypt models is based on automated confirmation of domain ownership (or to be more accurate, control rather than ownership). Automated software proves that the entity who is asking for a cert for a.example.com really does have control over a.example.com, because they were able to make a change on the host that a.example.com refers to. And based on this, issues the cert to the entity. This level of proof…

Wouldn't they just need to verify control of the domain, instead of a single host on the domain? If I control example.com, it's fair to believe I can control all hosts on the domain.

Re: Let's Encrypt is Trusted

#265

Post by teabee89 »

Are they planning on not relying on a 3rd party root CA and instead, ask all browsers and OS vendors to include LetsEncrypt CA? IOW, is this [trusting IdenTrust] a first step, or is this the original goal?

Re: Let's Encrypt is Trusted

#266

Post by bpicolo »

NateDad wrote: post #63
bpicolo wrote: post #57

Earlier quoted context omitted.

They provide docker packaging. So it's just as dep-free as Go. Not to mention python is on pretty much every platform in existence by default. If you're expecting this as a global binary like you would in go there's no reason you can't just "pip install letsencrypt"...

> They provide docker packaging. So it's just as dep-free as Go. ...except needing docker and everything running it in a docker container entails over a simple CLI. Also, it looks like they say "for god's sake don't pip install": Please do not use python setup.py install or ``sudo pip install`. Those mode of operation might corrupt your operating system and is not supported by the Let’s Encrypt team! https://letsencr…

That doesn't say not to use pip install. It says not to do it as root. So yes, pip install away

Re: Let's Encrypt is Trusted

#267

Post by mangeletti »

icebraining wrote: post #258
bandrami wrote: post #189

Earlier quoted context omitted.

It's not worse; it's just exactly the same broken model, now for no money and being pushed on everyone. All this because a couple of theorists in the 1990s decided that security requires authenticity, despite decades of research to the contrary. There are all kinds of ways to establish authenticity of counterparties. Entire books are written about that. There are much better ways than our current CA model. But we don…

Who claims that you can't have a passively secured transport without authentication? I mean, SSL/TLS itself uses DH key exchange, which can be used for that purpose. The problem is having secured transport against active attacks as well, and without forcing the user to know anything about the site besides its domain.

The problem, which I've stated, is not that Let's Encrypt is doing something bad. It's that they have zero economic incentive to protect their brand when a subpoena comes for their private key. If you think this doesn't matter, I honestly recommend studying economics. I'm not being sarcastic at all. In fact, https://en.wikipedia.org/wiki/Economics_of_security, albeit short, is a great place to start.

Re: Let's Encrypt is Trusted

#268

Post by kej »

teabee89 wrote: post #265

Are they planning on not relying on a 3rd party root CA and instead, ask all browsers and OS vendors to include LetsEncrypt CA? IOW, is this [trusting IdenTrust] a first step, or is this the original goal?

This is a temporary step. There are two versions of their intermediate cert, the one in this article that is cross-signed and another that is signed by their own root (which isn't yet included everywhere). There's a diagram on this page that explains the situation: https://letsencrypt.org/certificates/

Re: Let's Encrypt is Trusted

#269

Post by pcunite »

ghshephard wrote: post #177
huskyr wrote: post #149

Earlier quoted context omitted.

> it took me just a couple of hours > to learn how the process is handled at StartSSL. Well, if something takes 'just a couple of hours' to learn i'll happily fork over some money to ease the pain. You can get certificates for $10/year nowadays.

"You can get certificates for $10/year nowadays." As a service to the community, could you name some places where you can do that?

I've been using namecheap.com. They work well. Will probably switch to Let's Encrypt in three years if everything checks out okay with them.

Re: Let's Encrypt is Trusted

#270

Post by devy »

mehrdada wrote: post #66
sarciszewski wrote: post #51

Earlier quoted context omitted.

Let's Encrypt isn't the first to offer free TLS certificates. I've attempted to maintain a list of all the providers that do (in one way or another), and it's currently 4: * CloudFlare https://www.cloudflare.com/ssl * StartSSL https://startssl.com * WoSign https://buy.wosign.com/free * Let's Encrypt https://letsencrypt.org For people reading this comment dozens of months in the future, a maintained list will be kept…

They are not quite the same thing: * CloudFlare doesn't give you a certificate. It terminates your TLS connection at their endpoint with a certificate they own the private key to. * StartSSL free tier is for non-commerical use only. * Haven't used WoSign so no idea what it is, but clicking on the link took was so laggy it didn't give me much confidence. (I personally wouldn't work with a company in China jurisdiction…

FYI, StartSSL's free personal SSL certificate only valid for new users for the first year, requires a valid U.S. physical non-commercial address for registration and is subject to $79 for revocation fee. Oh, it's definitely not automated, someone would have to email you back and force a couple times to complete the provision process.

I wouldn't bother with StartSSL with that many catches and hassles.

How do I know? I've got two of them in the past in two occasions.

Post reply on HN