Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Standing on our own two feet

letsencrypt.org

Post reply on HN
Print view View original

101–110 of 200 posts

Re: Standing on our own two feet

#101

Post by laughinghan »

josephg wrote: post #84
laughinghan wrote: post #63

Earlier quoted context omitted.

The man-in-the-middle can self-sign their own certs and present it to you as the site's own self-signed cert. Unless you have some way to verify self-signed certs out-of-band, they're useless.

They’re not useless. They stop passive adversaries, like the Australian government. They just don’t stop active adversaries. Browser security warnings imply https > http > self signed https. The correct order of should be https > self signed https > http.

Interesting point. BTW I love your blog and your work on ShareJS :)

Re: Standing on our own two feet

#103

Post by vhiremath4 »

The company I work at is in a high-growth phase and we are going to be expanding our global audience this coming year through various channels (SEO, performance marketing, sales, etc.). A 1-5% hit in potential customer traffic is not going to fly. Is my only option here to get off LetsEncrypt? A bit of a vent, but I would 100% had paid for a version of LetsEncrypt that supported their costs for the x-signature with IdenTrust, although I know and respect that would be off-brand for LE.

Re: Standing on our own two feet

#105

Post by CGamesPlay »

kickscondor wrote: post #46
superdisk wrote: post #42

Earlier quoted context omitted.

The NSA can see what pages you read, and men in the middle can modify the page to insert malicious JS or ads or whatever without HTTPS.

Ok - next question then: why do browsers block self-signed certs? If Lets Encrypt now allows any domain to get a cert, what's the harm in a self-signed cert? Seems like a step up from plain HTTP.

I feel like this is an oversight due to the path we took to arrive here. HTTP website: no warning, "insecure" mark in the URL bar. Trusted HTTPS website: no warning, "secure" mark in the URL bar. Untrusted HTTPS website: impossible to open in modern browsers by normal users. Really, a non-expired, otherwise-valid self-signed certificate should be treated the same as an HTTP website is. But since LetsEncrypt made self-signed certificates much less common, I doubt there's going to be energy put into improving the experience with them.

Re: Standing on our own two feet

#106

Post by maxmcd »

miohtama wrote: post #73

Somewhat related, but in other thread two weeks ago people complain Google has too much power over Android ecosystem: https://news.ycombinator.com/item?id=24917918 Now, here people are suggesting Google should somehow update the old Androids. Be damned one way or the other.

People complaining is pretty constant, yeah. People even complain about complaining.

Re: Standing on our own two feet

#107

Post by mafuy »

vhiremath4 wrote: post #103

The company I work at is in a high-growth phase and we are going to be expanding our global audience this coming year through various channels (SEO, performance marketing, sales, etc.). A 1-5% hit in potential customer traffic is not going to fly. Is my only option here to get off LetsEncrypt? A bit of a vent, but I would 100% had paid for a version of LetsEncrypt that supported their costs for the x-signature with I…

You certainly can't go to IdenTrust now either. No matter what you do, you'll lose access to those old-phone-people eventually, and paying would only lengthen the time slightly. Just like you already lost access to people with even older android phones. Some of my family is still on androids as old as version 2.

Re: Standing on our own two feet

#108

Post by 1337shadow »

alanfranz wrote: post #57
gioele wrote: post #7

> Without IdenTrust, Let’s Encrypt may have never happened and we are grateful to them for their partnership. What I have never understood is why IdenTrust accepted to cross-sign Let’s Encrypt's root certificate. With that move, IdenTrust basically broke the CA cartel and helped driving the price of basic certificates to zero. How did they, as a for-profit organization, justify "doing the right thing" when that meant…

Maybe IdenTrust will now offer an ACME compatible endpoint and offer signed, paid certs with their CA. Or another CA will. I wonder whether IdenTrust imagined that a five year cross signed root ca would be too little a timespan to get wide adoption. Btw... Wouldn't it be possible to just add a new root ca to android? Maybe an app could simplify delivery?

The article says firefox app comes with its own up to date certificates which they maintain outside of the os, so there's that solution apparently.

Re: Standing on our own two feet

#109

Post by mafuy »

t3rabytes wrote: post #97
halukakin wrote: post #92

Earlier quoted context omitted.

This also depends on the country. For instance in Poland android has 99% market share. So 1/3 Poland residents will experience issues.

That’s a pretty bad assumption. Just because 99% of Polish folks use Android doesn’t mean that 33% of those phones are in the group that doesn’t have the cert. “will” is strong.

That's right - it could also be even more :)

Re: Standing on our own two feet

#110

Post by throwaway525142 »

josephg wrote: post #84
laughinghan wrote: post #63

Earlier quoted context omitted.

The man-in-the-middle can self-sign their own certs and present it to you as the site's own self-signed cert. Unless you have some way to verify self-signed certs out-of-band, they're useless.

They’re not useless. They stop passive adversaries, like the Australian government. They just don’t stop active adversaries. Browser security warnings imply https > http > self signed https. The correct order of should be https > self signed https > http.

We're getting there, HTTP is going to be marked as insecure in the future as well. It's just the massive amount of HTTP sites that couldn't get marked as insecure before, due to the then resulting warning fatigue in users.
Post reply on HN