Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Standing on our own two feet

letsencrypt.org

Post reply on HN
Print view View original

11–20 of 200 posts

Re: Standing on our own two feet

#11

Post by baggy_trough »

est31 wrote: post #5
brendanclune wrote: post #4

Earlier quoted context omitted.

Workaround is Firefox Mobile (because it ships with its own root certs), but that's a significant burden to place on the user.

Also the post says that Firefox doesn't work on Androids older than 5.0 which according to the dashboard are still 5.9% of devices. For those older devices, the only option is to install the new root certificate. Anyways, there are billions of Android devices out there. 33% of those is a large number. You can't just tell all of them that they are wrong. If this happens, people will move away from Let's encrypt in mas…

Not sure about that. Move away from Let's Encrypt to what? More likely, most smaller to medium sized sites will say forget those old Android guys.

Re: Standing on our own two feet

#12

Post by est31 »

admax88q wrote: post #8
gioele wrote: post #7

> Without IdenTrust, Let’s Encrypt may have never happened and we are grateful to them for their partnership. What I have never understood is why IdenTrust accepted to cross-sign Let’s Encrypt's root certificate. With that move, IdenTrust basically broke the CA cartel and helped driving the price of basic certificates to zero. How did they, as a for-profit organization, justify "doing the right thing" when that meant…

Always better to be doing the disruption rather be the one being disrupted. Perhaps they saw the writing on the walls and wanted to boost their standing in the post LetsEncrypt world.

Yeah they likely got a stash of money for it while the other CAs got nothing. First mover advantage I guess. It's not that they'd have been able to prevent it anyways, as the root stores are not under their control, especially when Let's encrypt is being supported, even started, by the entities which run the root stores (Mozilla, through Firefox, and Google, through Android). Ultimately it's the entities which run and deploy the root stores who have ultimate say on which CA gets to issue certs and which doesn't.

Re: Standing on our own two feet

#13

Post by Aissen »

This might also concern you if your app is running on older android devices, and you have a backend that uses letsencrypt certificates, while the app is relying on the system root CAs.

A fix for this could be to add Let's Encrypt's root CA to your app.

Re: Standing on our own two feet

#14

Post by nevi-me »

Could Google possibly be able (before were discuss willingness) to push an update to root certificate via Play Services?

I'd like to think that anyone not using Play Services (i.e. Android with no Play) is likely using a custom browser, and would heed a call to switch to Firefox.

The problem with some devices in Africa would be that many people will using older phone often don't have enough data for the big Play updates to succeed.

Teens often buy 10-100MB of data so they can use WhatsApp. (If you're from Southern Africa, and disagree with this, hit me up, you probably need to spend some time in a village ;) )

Re: Standing on our own two feet

#15

Post by WorldMaker »

est31 wrote: post #5
brendanclune wrote: post #4

Earlier quoted context omitted.

Workaround is Firefox Mobile (because it ships with its own root certs), but that's a significant burden to place on the user.

Also the post says that Firefox doesn't work on Androids older than 5.0 which according to the dashboard are still 5.9% of devices. For those older devices, the only option is to install the new root certificate. Anyways, there are billions of Android devices out there. 33% of those is a large number. You can't just tell all of them that they are wrong. If this happens, people will move away from Let's encrypt in mas…

Root certificate updates are a massive security issue. Blaming Let's Encrypt is blaming one of the canaries for the coal mine disaster. 33% of Android devices don't and can't get up to date root certificates is an impressive security crisis that grows worse by the year (look at the other root expirations and the crazy workarounds that for instance Netflix has been doing to still work on older Android devices). Shouldn't the blame squarely be on Google, the Android OEMs, and the phone carriers for allowing this disaster to happen in the first place?

I realize that is a tough message to get out to users and site owners are going to be in the cross-fire, but it seems better to try to work for solidarity in pointing fingers at the right direction and the right direction certainly isn't Let's Encrypt.

Re: Standing on our own two feet

#16

Post by veeti »

est31 wrote: post #5
brendanclune wrote: post #4

Earlier quoted context omitted.

Workaround is Firefox Mobile (because it ships with its own root certs), but that's a significant burden to place on the user.

Also the post says that Firefox doesn't work on Androids older than 5.0 which according to the dashboard are still 5.9% of devices. For those older devices, the only option is to install the new root certificate. Anyways, there are billions of Android devices out there. 33% of those is a large number. You can't just tell all of them that they are wrong. If this happens, people will move away from Let's encrypt in mas…

You can still install the last version of Firefox to support Android 4.x.

Re: Standing on our own two feet

#17

Post by dubcanada »

gioele wrote: post #7

> Without IdenTrust, Let’s Encrypt may have never happened and we are grateful to them for their partnership. What I have never understood is why IdenTrust accepted to cross-sign Let’s Encrypt's root certificate. With that move, IdenTrust basically broke the CA cartel and helped driving the price of basic certificates to zero. How did they, as a for-profit organization, justify "doing the right thing" when that meant…

IdenTrust doesn't care about random websites, they care about HIPPA, enterprise, government, securing documents and emails, etc.

Re: Standing on our own two feet

#19

Post by cpach »

WorldMaker wrote: post #15
est31 wrote: post #5

Earlier quoted context omitted.

Also the post says that Firefox doesn't work on Androids older than 5.0 which according to the dashboard are still 5.9% of devices. For those older devices, the only option is to install the new root certificate. Anyways, there are billions of Android devices out there. 33% of those is a large number. You can't just tell all of them that they are wrong. If this happens, people will move away from Let's encrypt in mas…

Root certificate updates are a massive security issue. Blaming Let's Encrypt is blaming one of the canaries for the coal mine disaster. 33% of Android devices don't and can't get up to date root certificates is an impressive security crisis that grows worse by the year (look at the other root expirations and the crazy workarounds that for instance Netflix has been doing to still work on older Android devices). Should…

That makes me curious, what workarounds did Netflix employ?

Re: Standing on our own two feet

#20

Post by juliend2 »

dubcanada wrote: post #17
gioele wrote: post #7

> Without IdenTrust, Let’s Encrypt may have never happened and we are grateful to them for their partnership. What I have never understood is why IdenTrust accepted to cross-sign Let’s Encrypt's root certificate. With that move, IdenTrust basically broke the CA cartel and helped driving the price of basic certificates to zero. How did they, as a for-profit organization, justify "doing the right thing" when that meant…

IdenTrust doesn't care about random websites, they care about HIPPA, enterprise, government, securing documents and emails, etc.

Exactly, but the funny thing is that Chrome and Firefox (Desktop at least) are no longer showing the differentiating green lock for those high-end (EV & OV) certs, but the same neutral-looking lock as those Domain-Validated (DV) certs that Let's Encrypt is issuing.

I'm very grateful for IdenTrust for having made that move. I just hope it won't hurt their business too much because of that.

Post reply on HN