Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Standing on our own two feet

letsencrypt.org

Post reply on HN
Print view View original

61–70 of 200 posts

Re: Standing on our own two feet

#61

Post by kibwen »

paulpauper wrote: post #41

i hate how google puts warnings on non-ssl sites. why doe a static page that has no forms need ssl? non-ssl worked fine for 20 years for webpages and google comes along and says noooo not good enough.

Recently there was a browser zero-day observed in the wild that operated by MITM'ing HTTP connections and injecting the payload into the response. You're thinking of HTTPS as protecting what information you send, but it also protects what you receive; with an HTTP connection, anyone in the middle can make your browser receive anything they want.

Re: Standing on our own two feet

#62

Post by traceddd »

superdisk wrote: post #42
paulpauper wrote: post #41

i hate how google puts warnings on non-ssl sites. why doe a static page that has no forms need ssl? non-ssl worked fine for 20 years for webpages and google comes along and says noooo not good enough.

The NSA can see what pages you read, and men in the middle can modify the page to insert malicious JS or ads or whatever without HTTPS.

To be fair, they probably can anyways, since the site willingly handed over their keys to Cloudflare, or rely on some Google CDN, host on EC2, etc.

It’s the second or third tier nation state actors that you can really make a difference with.

Re: Standing on our own two feet

#63

Post by laughinghan »

kickscondor wrote: post #46
superdisk wrote: post #42

Earlier quoted context omitted.

The NSA can see what pages you read, and men in the middle can modify the page to insert malicious JS or ads or whatever without HTTPS.

Ok - next question then: why do browsers block self-signed certs? If Lets Encrypt now allows any domain to get a cert, what's the harm in a self-signed cert? Seems like a step up from plain HTTP.

The man-in-the-middle can self-sign their own certs and present it to you as the site's own self-signed cert. Unless you have some way to verify self-signed certs out-of-band, they're useless.

Re: Standing on our own two feet

#65

Post by regecks »

colinclerk wrote: post #64

Does anyone have experiences with ZeroSSL? Caddy has been building in support so I think it could be a drop-in replacement for Caddy/CertMagic/ACMEx users.

ZeroSSL is operated by Sectigo (Comodo). It works fine with Certbot and should work fine with any ACME client.

I did run into some random 503s occasionally, but that was pretty soon after it was launched. Maybe just a few teething issues.

Re: Standing on our own two feet

#67

Post by Havoc »

renewiltord wrote: post #25

> The remaining 33.8% of Android devices will eventually start getting certificate errors when users visit sites that have a Let’s Encrypt certificate. In our communications with large integrators, we have found that this represents around 1-5% of traffic to their sites. This one-third of Android devices only yields 5% of traffic? Interesting.

Crappy expensive internet means it's not instinct to squeeze a quick browsing session into every free minute

Re: Standing on our own two feet

#68

Post by mholt »

colinclerk wrote: post #64

Does anyone have experiences with ZeroSSL? Caddy has been building in support so I think it could be a drop-in replacement for Caddy/CertMagic/ACMEx users.

ACMEz* ;)

Seconding regecks' comment.

We're gradually making ZeroSSL a default CA for Caddy.

(I am currently implementing multi-CA support into Caddy and CertMagic, so that Caddy will be able to use both Let's Encrypt and ZeroSSL for redundancy. It's the first server to support this!)

This is a good thing for the ecosystem.

Re: Standing on our own two feet

#69

Post by regecks »

lights0123 wrote: post #48
lixtra wrote: post #23

They propose to install Firefox to work around the root certificate problem on old android devices. But can’t you just manually install their root certificate on most phones?

It probably looks a lot less sketchy to your users to tell them to install a browser they've probably heard of and may have used in the past than install a root certificate. Plus, that doesn't fix the problem of other certificates expiring, only extends it.

>Plus, that doesn't fix the problem of other certificates expiring, only extends it.

Although I agree fully on the sketchiness part, installing the root is a fix.

ISRG Root X1 expires in 2035. Not one of these problematic Android devices will be online anymore.

Re: Standing on our own two feet

#70

Post by jacquesm »

WorldMaker wrote: post #15
est31 wrote: post #5

Earlier quoted context omitted.

Also the post says that Firefox doesn't work on Androids older than 5.0 which according to the dashboard are still 5.9% of devices. For those older devices, the only option is to install the new root certificate. Anyways, there are billions of Android devices out there. 33% of those is a large number. You can't just tell all of them that they are wrong. If this happens, people will move away from Let's encrypt in mas…

Root certificate updates are a massive security issue. Blaming Let's Encrypt is blaming one of the canaries for the coal mine disaster. 33% of Android devices don't and can't get up to date root certificates is an impressive security crisis that grows worse by the year (look at the other root expirations and the crazy workarounds that for instance Netflix has been doing to still work on older Android devices). Should…

They will be happy to accept that blame, as long as you fork over your $ for a new device. Planned obsolescence can have many components, this is just one of them.
Post reply on HN