Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Standing on our own two feet

letsencrypt.org

Post reply on HN
Print view View original

81–90 of 200 posts

Re: Standing on our own two feet

#81

Post by est31 »

baggy_trough wrote: post #11
est31 wrote: post #5

Earlier quoted context omitted.

Also the post says that Firefox doesn't work on Androids older than 5.0 which according to the dashboard are still 5.9% of devices. For those older devices, the only option is to install the new root certificate. Anyways, there are billions of Android devices out there. 33% of those is a large number. You can't just tell all of them that they are wrong. If this happens, people will move away from Let's encrypt in mas…

Not sure about that. Move away from Let's Encrypt to what? More likely, most smaller to medium sized sites will say forget those old Android guys.

I found at least Buypass offering a gratis ACME product "Buypass Go SSL". They have roots which are deployed at least since Android 4.1, which covers way more Android devices (according to the Android Studio statistics, >99%):

https://android.googlesource.com/platform/libcore/+/android-...

I'm not sure whether that particular root is being used for their Go SSL product. If so, Buypass might be a good alternative to migrate to.

From what I read though, they do require an E-Mail address, so you've got to keep that in mind.

Re: Standing on our own two feet

#82

Post by DivineEntropy »

closeparen wrote: post #53
kickscondor wrote: post #46

Earlier quoted context omitted.

Ok - next question then: why do browsers block self-signed certs? If Lets Encrypt now allows any domain to get a cert, what's the harm in a self-signed cert? Seems like a step up from plain HTTP.

What you are trusting, when you trust a CA, is that it will only issue a certificate for a domain to someone it has verified as the owner. A self-signed cert could be from a man in the middle attacker. An active MITM is a relatively more exotic threat than a passive observer. In the days when certificates cost money, there was a legitimate argument that you shouldn't need the whole elaborate active-MITM defense just…

Small nit, verification is only meant to prove control over the domain, not ownership.

Re: Standing on our own two feet

#83

Post by iudqnolq »

regecks wrote: post #69
lights0123 wrote: post #48

Earlier quoted context omitted.

It probably looks a lot less sketchy to your users to tell them to install a browser they've probably heard of and may have used in the past than install a root certificate. Plus, that doesn't fix the problem of other certificates expiring, only extends it.

>Plus, that doesn't fix the problem of other certificates expiring, only extends it. Although I agree fully on the sketchiness part, installing the root is a fix. ISRG Root X1 expires in 2035. Not one of these problematic Android devices will be online anymore.

But to have the whole modern web work you'll need to install more than one root.

Re: Standing on our own two feet

#84

Post by josephg »

laughinghan wrote: post #63
kickscondor wrote: post #46

Earlier quoted context omitted.

Ok - next question then: why do browsers block self-signed certs? If Lets Encrypt now allows any domain to get a cert, what's the harm in a self-signed cert? Seems like a step up from plain HTTP.

The man-in-the-middle can self-sign their own certs and present it to you as the site's own self-signed cert. Unless you have some way to verify self-signed certs out-of-band, they're useless.

They’re not useless. They stop passive adversaries, like the Australian government. They just don’t stop active adversaries.

Browser security warnings imply https > http > self signed https. The correct order of should be https > self signed https > http.

Re: Standing on our own two feet

#85

Post by josephg »

fuzxi wrote: post #79
stefan_ wrote: post #74

Earlier quoted context omitted.

Well that's an easy choice, lose 1-5% of traffic or pay $100 for a certificate from a vendor whose root doesn't expire next year?

1-5% of traffic that comes from people using devices that are at least 4 years old. Someone who can't or won't upgrade from a phone that still uses Android Marshmallow is probably not bringing in much revenue.

Exactly. The “easy choice” is to drop support for those users. I suspect most web developers won’t even notice.

It’s a pity - there’s no essential reason why old phones with new batteries should get worse over time. But software kills them in so many ways.

Re: Standing on our own two feet

#86

Post by tacon »

w3ll_w3ll_w3ll wrote: post #59
TheKIngofBelAir wrote: post #43

Earlier quoted context omitted.

> Also the post says that Firefox doesn't work on Androids older than 5.0 which according to the dashboard are still 5.9% of devices. For those older devices, the only option is to install the new root certificate. Microsoft Edge still gets updates on Android 4.4 KitKat

I don't think Microsft Edge embeds its own root store on Android.

Is there enough incentive for Microsoft to add a root store to Edge by next September? How hard is it to make that addition?

Re: Standing on our own two feet

#87

Post by andymatuschak »

gioele wrote: post #7

> Without IdenTrust, Let’s Encrypt may have never happened and we are grateful to them for their partnership. What I have never understood is why IdenTrust accepted to cross-sign Let’s Encrypt's root certificate. With that move, IdenTrust basically broke the CA cartel and helped driving the price of basic certificates to zero. How did they, as a for-profit organization, justify "doing the right thing" when that meant…

It seems like a case of “commoditize your complement” to me. https://www.gwern.net/Complement

They offer a variety of enterprises services and can now capture more of the marginal consumer value relative to competitors still fighting for the cert issuing market.

Re: Standing on our own two feet

#88

Post by gsich »

superdisk wrote: post #42
paulpauper wrote: post #41

i hate how google puts warnings on non-ssl sites. why doe a static page that has no forms need ssl? non-ssl worked fine for 20 years for webpages and google comes along and says noooo not good enough.

The NSA can see what pages you read, and men in the middle can modify the page to insert malicious JS or ads or whatever without HTTPS.

As a site owner that is somehow not my problem. It's not my fault that you have a shitty ISP. I can understand and support that argument.

I do TLS only for my stuff however.

Re: Standing on our own two feet

#89

Post by tyingq »

gpff wrote: post #2

Let’s Encrypt cross-signature with IdenTrust "DST Root X3" is ending on September 1, 2021 but 33.8% of Android devices are running versions under 7.1 which don't trust Let’s Encrypt new root certificate "ISRG Root X1"

"https almost everywhere".

Thanks G!

Re: Standing on our own two feet

#90

Post by inquirerofsorts »

gsich wrote: post #88
superdisk wrote: post #42

Earlier quoted context omitted.

The NSA can see what pages you read, and men in the middle can modify the page to insert malicious JS or ads or whatever without HTTPS.

As a site owner that is somehow not my problem. It's not my fault that you have a shitty ISP. I can understand and support that argument. I do TLS only for my stuff however.

> It's not my fault that you have a shitty ISP.

Really don't think you're grasping this and lack an understanding of packet routing.

Please type:

  traceroute apache.org
It's not just your ISP that's potentially shitty, it's every single hop on that list. Even worse if the person is using an open wifi connection.

Apache will happily serve you an insecure connection, they are the 80th top site on the internet. This type of stuff should be called out by technologists and it's incredibly disappointing when its handwaved away.

Post reply on HN