ACME v2 and Wildcard Certificate Support is Live • Hacker News Board

Re: ACME v2 and Wildcard Certificate Support is Live

#221

Post by peterwwillis » Wed, Mar 14, 2018, 3:12 AM UTC

0x0 wrote: post #70

eric_b wrote: post #55

Earlier quoted context omitted.

> Those devs are gonna be really surprised when they find out that unencrypted connections are routinely tampered with. Except most big orgs now employ MitM tools like BlueCoat to sniff SSL connections too. > You have not been paying attention to the hundreds of tools available to make HTTPS painless. I have, and they don't. They make it easier, but you know what's truly painless? Hosting an html file over HTTP. What…

A lot of ISPs, some huge like the "XfinityWifi" SSID, routinely inject their own javascript in HTTP pages. Some even take no care to namespace their javascript and wreck a party on your window globals, too.

This could be solved without HTTPS. People choose not to for ideological reasons.

Re: ACME v2 and Wildcard Certificate Support is Live

#222

Post by peterwwillis » Wed, Mar 14, 2018, 3:18 AM UTC

jsmthrowaway wrote: post #76

eric_b wrote: post #65

Earlier quoted context omitted.

But why did it make you so angry? My guess is because my viewpoint is completely unfathomable to you. You can't even believe that someone would advocate for it. In situations like that, I always try and put myself in the shoes of that person. Sometimes they are wrong, and sometimes they have a point. But it's always a useful exercise. To your parent comment - No, I don't think it's a cabal of "grumpy old men" - I thi…

What the gently caress does encrypting an HTTP connection have to do with morals or age? You are way outside the realm of making sense, man, and offer commentary that is openly harmful to securing the Internet. Please step back and revisit your woefully misinformed opinion on this. Most people who advocate for security, including myself, have worked on small teams and understand the resources involved. Putting a TLS…

> offer commentary that is openly harmful to securing the Internet

Funny you mention this.

With this new functionality, I can register valid certs for any domain in the world if their DNS is insecure, or if I can spoof it.

Have we gotten any headway yet on that whole "anyone can hijack BGP from a mom and pop ISP" thing ?

How many CAs are still trusted by browsers, again? How many of those run in countries run by dictators?

HTTPS doesn't secure the Internet. It's security theater for e-commerce.

Re: ACME v2 and Wildcard Certificate Support is Live

#223

Post by tialaramex » Wed, Mar 14, 2018, 3:21 AM UTC

Karunamon wrote: post #143

Jaruzel wrote: post #116

Earlier quoted context omitted.

For the standard LE certs, you need a public facing web server for the domain name in question, and LE give you a keyfile to put into: '/.well-known/pki-validation' For the wildcard certs, you just need to add a TXT record to the public DNS entry, no public web server required. Even if you have no intention of using your internal DNS domain name on the internet, it's good practice to register it anyway.

Is there a "standard" TLD for internal use that will also fit this requirement? The problem here is that there's no such thing as domain ownership, only domain renting. You forget to pay your bill (read: someone loses an email) and a core part of your infrastructure is up in smoke, or worse, taken over by a squatter.

It makes no sense to have publicly trusted certificates for names that have no defined legitimate meaning - what is being certified? Nothing. Accordingly no public CA is permitted to issue such certs.

Re: ACME v2 and Wildcard Certificate Support is Live

#224

Post by tialaramex » Wed, Mar 14, 2018, 3:26 AM UTC

eric_b wrote: post #44

neals wrote: post #3

The amount of money I've paid for this... I recon some of these providers are going under soon?

I'll happily pay money to get a cert that expires in 3 years instead of 90 days. Some of us don't feel like faffing about with cert renewal every quarter. (I know there are tools and clients that can "make it seamless" - until the ACME endpoints are down or something).

Well then you are two weeks late. The maximum lifetime for a certificate is now 825 days, most commercial CAs are selling only 1 or 2 year certificates, with the extra days used to allow early renewals to "carry over" a few weeks.

Re: ACME v2 and Wildcard Certificate Support is Live

#225

Post by megous » Wed, Mar 14, 2018, 3:27 AM UTC

Karunamon wrote: post #117

vertex-four wrote: post #94

Earlier quoted context omitted.

> We're right back to the same level of security of you just checking that the browser bar points at the domain you actually intended to go to. So you’re sitting in a cafe, and you go to Facebook.com. Lo and behold, someone’s installed a MITM proxy on the router, that presents its own encryption key instead of Facebook’s, and your browser has no way to tell this because the CA system isn’t a thing. They now have your…

Idea that's been floated before: TOFU plus a distributed network of people automatically sharing what cert fingerprints they encounter. Chances are high that you already hit Facebook on your $device, and if you all of a sudden retrieved a certificate that didn't match the one you had before, or that most other people online hadn't seen, halt and throw up the warnings. Given the exploitability, laziness, general failu…

Where do you store the trust from all those people to be able to query the statistics? That's just another central point of failure.

Re: ACME v2 and Wildcard Certificate Support is Live

#226

Post by Nexxxeh » Wed, Mar 14, 2018, 3:29 AM UTC

ancarda wrote: post #62

eric_b wrote: post #60

Earlier quoted context omitted.

> At the risk of all my karma, honestly, fuck off. Thin-skinned immature response aside, what you lack is empathy. You can't possibly understand why someone would take my stance. It's your lack of empathy I despise. Look at the replies to my comment - people are losing their minds. It's this rabid dogma that frightens me, and frankly makes me hate the infosec community in general. To you, security is the only thing t…

I wrote that in anger, and almost right away removed it when I calmed down. Please see my current comment.

It's rather bad form to do so without noting what you edited in the comment itself, especially as your parent poster replied to it.

Re: ACME v2 and Wildcard Certificate Support is Live

#227

Post by aplorbust » Wed, Mar 14, 2018, 3:45 AM UTC

mholt wrote: post #49

eric_b wrote: post #43

Earlier quoted context omitted.

The SSL zealotry drives me nuts. The infosec community screams constantly about "HTTPS everywhere", but they either don't know or don't care about all the effort and pain they're creating for developers who just want their software to work. How many perfectly good sites will be marked ominously as "insecure" by Chrome in the next few months? Sites that were working just fine until someone at Big G decided they weren'…

> developers who just want their software to work. Those devs are gonna be really surprised when they find out that unencrypted connections are routinely tampered with. > they either don't know or don't care about all the effort and pain they're creating You have not been paying attention to the hundreds of tools available to make HTTPS painless. > until someone at Big G decided they weren't. And Mozilla. And countle…

"It's their privacy being deprived."

I wonder if anyone will be surprised when they learn how HTTPS and HTTP/2 will be used to push more advertising to users and exfiltrate more user data from them than HTTP would ever allow.

Will these "advances" benefit users more than they benefit the companies serving ads, collecting user data and "overseeing the www" generally? Is there a trade-off?

To users, will protecting traffic from manipulation be viewed as a step forward if as a result they only see an increase in ads and data collection?

Even more, perhaps they will have limited ability to "see" the increase in data collection if they have effectively no control over the encryption process. (e.g., too complex, inability to monitor the data being sent, etc.)

Re: ACME v2 and Wildcard Certificate Support is Live

#228

Post by tialaramex » Wed, Mar 14, 2018, 3:47 AM UTC

deathanatos wrote: post #156

mholt wrote: post #114

Earlier quoted context omitted.

But issuing 3-year certificates would disqualify them as a CA: https://cabforum.org/wp-content/uploads/CA-Browser-Forum-BR-...

Can you elaborate as to why that would disqualify them? I don't think most of us are intimately familiar with the Baseline Requirements, or want to wade through 60-some pages to figure out your reasoning.

Three years is much too long. Last year Google's Ryan Sleevi basically said this needs to be much shorter, it takes far too long to fix anything properly with such long-lived certs. Ryan pointed out that it they couldn't get traction by agreement then Chrome can totally just be modified to count certs as expiring after 90 days and that's that. Unsurprisingly CAs did not go "OK we'll do what Ryan suggests, 90 days it is" but they also didn't try to stick with the status quo of 39 months and call Ryan's bluff. The compromise that got enough votes was 825 days for all certs after 1 March 2018.

For future reference - the BRs have a section with a timeline, it's great for finding upcoming or recent changes significant enough that the CAs needed a deadline.

Re: ACME v2 and Wildcard Certificate Support is Live

#229

Post by cbo100 » Wed, Mar 14, 2018, 3:48 AM UTC

peterwwillis wrote: post #219

schoen wrote: post #218

Earlier quoted context omitted.

We've been using TXT records to authenticate certificate requests since Let's Encrypt launched. That hasn't changed.

Without verifying who controls the IP space? If you don't verify who controls the IP space, then if you can control the DNS, you can generate certs. Certs that appear valid to unsuspecting users. Putting that kind of trust in DNS is pretty crazy considering how insecure most DNS setups are. Not to mention general attacks on DNS. There's even a potential chicken and egg problem, if you need DNS to secure your HTTPS, b…

> What am I missing here?

If I "own your DNS" wouldn't I just change them all to an IP space I control anyway? (If that was a requirement).

Unless I'm missing something, requiring "owning the IP space" seems to be an impossible requirement to fulfil. I'm on a virtual host in Azure/AWS/Linode I have no way of proving I own the IP (because I don't).

Re: ACME v2 and Wildcard Certificate Support is Live

#230

Post by tialaramex » Wed, Mar 14, 2018, 3:59 AM UTC

peterwwillis wrote: post #219

schoen wrote: post #218

Earlier quoted context omitted.

We've been using TXT records to authenticate certificate requests since Let's Encrypt launched. That hasn't changed.

Without verifying who controls the IP space? If you don't verify who controls the IP space, then if you can control the DNS, you can generate certs. Certs that appear valid to unsuspecting users. Putting that kind of trust in DNS is pretty crazy considering how insecure most DNS setups are. Not to mention general attacks on DNS. There's even a potential chicken and egg problem, if you need DNS to secure your HTTPS, b…

If you're concerned about DNS security you can use DNSSEC and Let's Encrypt will cheerfully require DNSSEC signed answers.

If your situation really is that you have unsecured DNS that routinely gets hacked and you just sort of muddle among somehow with users frequently getting phished, malware downloaders, and so on, well, I guess Let's Encrypt doesn't magically solve the trouble you've stepped in.