letsencrypt is great and I use it. But I don't really get it. All I needed to do was prove that I could place a generated file on the server that I wanted the certificate for. This seems to me to be a very low bar. What am I missing?
How not to run a CA
21–30 of 255 posts
Re: How not to run a CA
#22Ironically his blog isn't available on https. Would be time that browers mark http sites' address bar as "Not secure" in orange. It's either secure or it isn't. Fun fact; Europe's ePrivacy law is coming next year which enforces all communication to be secure.
Which they cannot enforce on the web except by blocking (aka censoring the web).
Re: How not to run a CA
#23Ironically his blog isn't available on https. Would be time that browers mark http sites' address bar as "Not secure" in orange. It's either secure or it isn't. Fun fact; Europe's ePrivacy law is coming next year which enforces all communication to be secure.
Security depends on your threat model. HTTP is generally secure for publishing and has the added advantage of being cacheable by proxies. This blog is secure
Re: How not to run a CA
#24letsencrypt is great and I use it. But I don't really get it. All I needed to do was prove that I could place a generated file on the server that I wanted the certificate for. This seems to me to be a very low bar. What am I missing?
They're not verifying your identity, just that you control the hardware running the domain that you want to generate a certificate for.
Re: How not to run a CA
#25Ironically his blog isn't available on https. Would be time that browers mark http sites' address bar as "Not secure" in orange. It's either secure or it isn't. Fun fact; Europe's ePrivacy law is coming next year which enforces all communication to be secure.
Which they cannot enforce on the web except by blocking (aka censoring the web).
They could fine you.
Re: How not to run a CA
#26They have a tool that allows you create a private key + CSR https://www.trustico.com/ssltools/create/csr-pem/create-a-ne... Apparently they decided to keep a copy of the private key. Edit: Looks like they are having problems atm. A copy can be found at https://web.archive.org/web/20180217071027/https://www.trust...
This probably happened because they allowed users to execute root commands on their server. Either they quickly shut down the site or someone else did it by shutting down some servers.
Re: How not to run a CA
#27SSL is fundamentally broken. Web-of-trust is the only real way to do security.
It's not. It's actually worse. You're assuming that random people on the internet are going to collectively be more secure than CAs, which is obviously not the case. Imagine you get an email signed by the IRS, and which is trusted by people A1, A2 and A3, who are trusted by people B1, B2, and B3 ... who are trusted by Z1, Z2, and Z3, who are fully trusted by you. Should be reliable, right? But while Z1, Z2 and Z3 may…
All you've told me is you don't understand web-of-trust.
Re: How not to run a CA
#28Ironically his blog isn't available on https. Would be time that browers mark http sites' address bar as "Not secure" in orange. It's either secure or it isn't. Fun fact; Europe's ePrivacy law is coming next year which enforces all communication to be secure.
Which they cannot enforce on the web except by blocking (aka censoring the web).
Right, because the only way we can control speeding is by barricading roads.
Re: How not to run a CA
#29Ironically his blog isn't available on https. Would be time that browers mark http sites' address bar as "Not secure" in orange. It's either secure or it isn't. Fun fact; Europe's ePrivacy law is coming next year which enforces all communication to be secure.
Security depends on your threat model. HTTP is generally secure for publishing and has the added advantage of being cacheable by proxies. This blog is secure
It can be MITM'd and used as a vector for malware.
Re: How not to run a CA
#30letsencrypt is great and I use it. But I don't really get it. All I needed to do was prove that I could place a generated file on the server that I wanted the certificate for. This seems to me to be a very low bar. What am I missing?
There's a difference in certificate type. Let's encrypt (which only issues basic certificates) just verifies that you're the rightful owner of a domain, not whether the domain is what it says.
If you'd like to have more verification for your certificate you need a extended validation certificate (which often costs money). These certificates also include your (company) name and the issuer verifies whether it's correct or not.
Basic certificate issuers don't judge over domain names or content, they just verify domain ownership.