Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

ACME v2 and Wildcard Certificate Support is Live

community.letsencrypt.org

Post reply on HN
Print view View original

151–160 of 321 posts

Re: ACME v2 and Wildcard Certificate Support is Live

#151

Post by yellowapple »

fanf2 wrote: post #138
Jaruzel wrote: post #80

Earlier quoted context omitted.

Going to reply to my own comment here. It's at this point that I swear profusely at Microsoft yet again, for pushing the concept of '.local' domain suffixes a decade ago. As it's not a legal TLD, I can't get certs for any of my internal services without rolling my own internal CA, which only works automatically for Windows domain machines, and not for anything else.

I agree that it’s terrible, but the reason they used to recommend .local goes back to their Small Businness Server in the 1990s when it was very expensive and bureaucratic to register a domain - not something they could demand of their target market. MS’s error was their failure to update their recommendations after domain registration became cheap and easy.

IIRC Microsoft does now recommend using a real domain with a real TLD nowadays.

Re: ACME v2 and Wildcard Certificate Support is Live

#153

Post by rospaya »

greglindahl wrote: post #90
rospaya wrote: post #83

Earlier quoted context omitted.

My favorite part of the internet were always the small hobyist websites. The guy that has an encyclopedic database about Grateful Dead trivia, the other guy that collects pictures of plants. Those people are independent, they're not technical and their 90s looking websites are going to go under because of blanket security policies that don't concern them.

You do realize you're making this complaint on a discussion about a tool that makes HTTPS easier for said small hobbyist websites? I've updated all of my hobby sites using Let's Encrypt, and I really appreciate how it was easy for me while also being good for my users.

My comment isn't against Let's Encrypt. It's against blacklisting text only sites that don't need HTTPS.

Re: ACME v2 and Wildcard Certificate Support is Live

#154

Post by dalore »

rospaya wrote: post #83
eric_b wrote: post #43

Earlier quoted context omitted.

The SSL zealotry drives me nuts. The infosec community screams constantly about "HTTPS everywhere", but they either don't know or don't care about all the effort and pain they're creating for developers who just want their software to work. How many perfectly good sites will be marked ominously as "insecure" by Chrome in the next few months? Sites that were working just fine until someone at Big G decided they weren'…

My favorite part of the internet were always the small hobyist websites. The guy that has an encyclopedic database about Grateful Dead trivia, the other guy that collects pictures of plants. Those people are independent, they're not technical and their 90s looking websites are going to go under because of blanket security policies that don't concern them.

Yeah and what do those hobbyists do? They go to a blogging service provider or something like a wiki provider and they put their stuff. That stuff still happens today. And of course those users wouldn't want someone else coming along and tampering with their collection, so https everywhere is a must. And these users won't even know or care.

Re: ACME v2 and Wildcard Certificate Support is Live

#155

Post by amaccuish »

Karunamon wrote: post #117
vertex-four wrote: post #94

Earlier quoted context omitted.

> We're right back to the same level of security of you just checking that the browser bar points at the domain you actually intended to go to. So you’re sitting in a cafe, and you go to Facebook.com. Lo and behold, someone’s installed a MITM proxy on the router, that presents its own encryption key instead of Facebook’s, and your browser has no way to tell this because the CA system isn’t a thing. They now have your…

Idea that's been floated before: TOFU plus a distributed network of people automatically sharing what cert fingerprints they encounter. Chances are high that you already hit Facebook on your $device, and if you all of a sudden retrieved a certificate that didn't match the one you had before, or that most other people online hadn't seen, halt and throw up the warnings. Given the exploitability, laziness, general failu…

And how would rollover work?

Re: ACME v2 and Wildcard Certificate Support is Live

#156

Post by deathanatos »

mholt wrote: post #114
ryandrake wrote: post #104

Earlier quoted context omitted.

The one that always sticks out is the certs’ extremely short expiration period. The IMHO weak rationale for this was mentioned in another thread here (See jjeaff‘s response upthread). It would be nice if they simply offered two choices: 1. I love automation! Give me a 90 day certificate. 2. I understand the security trade-offs. Give me a 3 year certificate.

But issuing 3-year certificates would disqualify them as a CA: https://cabforum.org/wp-content/uploads/CA-Browser-Forum-BR-...

Can you elaborate as to why that would disqualify them? I don't think most of us are intimately familiar with the Baseline Requirements, or want to wade through 60-some pages to figure out your reasoning.

Re: ACME v2 and Wildcard Certificate Support is Live

#157

Post by rospaya »

__jal wrote: post #134
rospaya wrote: post #83

Earlier quoted context omitted.

My favorite part of the internet were always the small hobyist websites. The guy that has an encyclopedic database about Grateful Dead trivia, the other guy that collects pictures of plants. Those people are independent, they're not technical and their 90s looking websites are going to go under because of blanket security policies that don't concern them.

If not SSL, then they'd go away at the point some other technical change dropped. Or do you suggest "we" continue using broken protocols forever in order to preserve them? Do you still support telnet to accommodate people who can't handle `ssh-keygen`? In any case, (a small subset of) the random enthusiast sites and such are close to the only reason I use a browser recreationally anymore. I absolutely agree with you.…

My point is that those sites don't need to be any more secure than they are. A hobbyist website written in HTML in Notepad with only text and images that can be run on IE 5.0 might not require HTTPS and Google and others might change that.

Re: ACME v2 and Wildcard Certificate Support is Live

#158

Post by Karunamon »

amaccuish wrote: post #155
Karunamon wrote: post #117

Earlier quoted context omitted.

Idea that's been floated before: TOFU plus a distributed network of people automatically sharing what cert fingerprints they encounter. Chances are high that you already hit Facebook on your $device, and if you all of a sudden retrieved a certificate that didn't match the one you had before, or that most other people online hadn't seen, halt and throw up the warnings. Given the exploitability, laziness, general failu…

And how would rollover work?

It would wind up being visible to a large chunk of users simultaneously. Furthermore, since we're relying on the wisdom of the crowd rather than a true CA, you'd be able to trust companies' own CAs rather than delegating off to a not-so-trusted third party.

In other words, if someone claiming to be Facebook has told a significant number of people all over the world that Facebook's cert fingerprint is ABCD124, and that fingerprint matches what they're getting presented, it's probably legitimate. We can add additional points for the cert signer being the same one as the previous cert, lack of listing in a CRL, cert transparency logs, etc.

There's no reason this system couldn't bolt on top of the existing CA infrastructure to avoid a bootstrapping problem either.

It adds a probability value into the mix, in other words. That value has always existed, but now we expose it to the user in some way and stop pretending that it does not.

Re: ACME v2 and Wildcard Certificate Support is Live

#159

Post by ocdtrekkie »

amaccuish wrote: post #150
Manozco wrote: post #136

Earlier quoted context omitted.

Technically, certificates automatically validated only guarantees that you are on the website that let's encrypt thinks correspond to facebook.com. MiTM state wide could tamper with it

How so?

Presumably, someone could MITM a CA, and get their own domain validated certificate to another site. The cert may protect you from MITM in a coffee shop, but it doesn't necessarily help you against state-level actors.

Re: ACME v2 and Wildcard Certificate Support is Live

#160

Post by jenscow »

rospaya wrote: post #153
greglindahl wrote: post #90

Earlier quoted context omitted.

You do realize you're making this complaint on a discussion about a tool that makes HTTPS easier for said small hobbyist websites? I've updated all of my hobby sites using Let's Encrypt, and I really appreciate how it was easy for me while also being good for my users.

My comment isn't against Let's Encrypt. It's against blacklisting text only sites that don't need HTTPS.

Nobody is blacklisting them. The visitors are just being informed of the risks.

The warning used to be the absence of a pad-lock, but who notices that?

Post reply on HN