Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Standing on our own two feet

letsencrypt.org

Post reply on HN
Print view View original

51–60 of 200 posts

Re: Standing on our own two feet

#51

Post by closeparen »

dubcanada wrote: post #17
gioele wrote: post #7

> Without IdenTrust, Let’s Encrypt may have never happened and we are grateful to them for their partnership. What I have never understood is why IdenTrust accepted to cross-sign Let’s Encrypt's root certificate. With that move, IdenTrust basically broke the CA cartel and helped driving the price of basic certificates to zero. How did they, as a for-profit organization, justify "doing the right thing" when that meant…

IdenTrust doesn't care about random websites, they care about HIPPA, enterprise, government, securing documents and emails, etc.

Does anyone in enterprise actually need publicly trusted certificates for documents and email? Seems like it's an inside-the-firewall Exchange server for internal traffic, and a white-label "secure messaging center" portal for external traffic.

Re: Standing on our own two feet

#53

Post by closeparen »

kickscondor wrote: post #46
superdisk wrote: post #42

Earlier quoted context omitted.

The NSA can see what pages you read, and men in the middle can modify the page to insert malicious JS or ads or whatever without HTTPS.

Ok - next question then: why do browsers block self-signed certs? If Lets Encrypt now allows any domain to get a cert, what's the harm in a self-signed cert? Seems like a step up from plain HTTP.

What you are trusting, when you trust a CA, is that it will only issue a certificate for a domain to someone it has verified as the owner. A self-signed cert could be from a man in the middle attacker.

An active MITM is a relatively more exotic threat than a passive observer. In the days when certificates cost money, there was a legitimate argument that you shouldn't need the whole elaborate active-MITM defense just to get protection against passive snooping. But now that you can get both for free... just use Let's Encrypt.

Re: Standing on our own two feet

#54

Post by young_unixer »

sandworm101 wrote: post #45
toast0 wrote: post #37

Earlier quoted context omitted.

No play services on an Android phone in the US probably implies willingness to tinker. No play services on an Android phone in China only implies it's an Android phone. In the developing world, it most likely implies a very low cost Android phone of Chinese origin. Bundling things that need timely updates with the OS with no mechanism to update them individually is a design error. Things like root certificates, time…

In an ideal world carriers wouldn't have a say in what software updates were installed on my phone. Comcast doesn't control the software on the computers it services. Why should Telus control what updates are made available for my phone?

Can't you buy hardware directly and then just put the carrier's SIM card?

Re: Standing on our own two feet

#55

Post by DanielDent »

I think a fairly manageable path forward is underway which makes this a smaller issue than it first seems:

(1) Firefox already uses its own root store

(2) App developers can include additional roots in addition to the system root store: https://developer.android.com/training/articles/security-con...

(3) Chrome is migrating to using it's own store: "Historically, Chrome has integrated with the Root Store provided by the platform on which it is running. Chrome is in the process of transitioning certificate verification to use a common implementation on all platforms where it's under application control, namely Android, Chrome OS, Linux, Windows, and macOS. Apple policies prevent the Chrome Root Store and verifier from being used on Chrome for iOS."

https://www.chromium.org/Home/chromium-security/root-ca-poli...

Re: Standing on our own two feet

#56

Post by [deleted] »

kickscondor wrote: post #46
superdisk wrote: post #42

Earlier quoted context omitted.

The NSA can see what pages you read, and men in the middle can modify the page to insert malicious JS or ads or whatever without HTTPS.

Ok - next question then: why do browsers block self-signed certs? If Lets Encrypt now allows any domain to get a cert, what's the harm in a self-signed cert? Seems like a step up from plain HTTP.

[deleted]

Re: Standing on our own two feet

#57

Post by alanfranz »

gioele wrote: post #7

> Without IdenTrust, Let’s Encrypt may have never happened and we are grateful to them for their partnership. What I have never understood is why IdenTrust accepted to cross-sign Let’s Encrypt's root certificate. With that move, IdenTrust basically broke the CA cartel and helped driving the price of basic certificates to zero. How did they, as a for-profit organization, justify "doing the right thing" when that meant…

Maybe IdenTrust will now offer an ACME compatible endpoint and offer signed, paid certs with their CA. Or another CA will.

I wonder whether IdenTrust imagined that a five year cross signed root ca would be too little a timespan to get wide adoption.

Btw... Wouldn't it be possible to just add a new root ca to android? Maybe an app could simplify delivery?

Re: Standing on our own two feet

#58

Post by laughinghan »

rsweeney21 wrote: post #35

I don't understand the motivation for making this change now. Why not keep the universally accepted root certificate as the default chain? Why does Let's Encrypt need to switch to their own root certificate now, and cause thousands of websites to break on older devices? I don't even control the certificate provisioning process. We use Heroku and Webflow. This is frustrating.

Did you miss the part where the "universally accepted" root certificate is going to be universally rejected in 10 months?

Re: Standing on our own two feet

#59

Post by w3ll_w3ll_w3ll »

TheKIngofBelAir wrote: post #43
est31 wrote: post #5

Earlier quoted context omitted.

Also the post says that Firefox doesn't work on Androids older than 5.0 which according to the dashboard are still 5.9% of devices. For those older devices, the only option is to install the new root certificate. Anyways, there are billions of Android devices out there. 33% of those is a large number. You can't just tell all of them that they are wrong. If this happens, people will move away from Let's encrypt in mas…

> Also the post says that Firefox doesn't work on Androids older than 5.0 which according to the dashboard are still 5.9% of devices. For those older devices, the only option is to install the new root certificate. Microsoft Edge still gets updates on Android 4.4 KitKat

I don't think Microsft Edge embeds its own root store on Android.

Re: Standing on our own two feet

#60

Post by zinekeller »

closeparen wrote: post #51
dubcanada wrote: post #17

Earlier quoted context omitted.

IdenTrust doesn't care about random websites, they care about HIPPA, enterprise, government, securing documents and emails, etc.

Does anyone in enterprise actually need publicly trusted certificates for documents and email? Seems like it's an inside-the-firewall Exchange server for internal traffic, and a white-label "secure messaging center" portal for external traffic.

IdenTrust's buisness also spans to managing private CAs for companies, which includes managing the HSM and private keys. Also, the companies who hire IdenTrust and similar companies are not that involved in technology. Also, security experts who can manage this safely is a tad harder to find and requests higher wages than your standard IT staff.

TLDR: yes, but some companies wants another company to manage their certs.

Post reply on HN