Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Let’s Encrypt Receives the Levchin Prize for Real-World Cryptography

letsencrypt.org

Post reply on HN
Print view View original

21–30 of 37 posts

Re: Let’s Encrypt Receives the Levchin Prize for Real-World Cryptography

#21

Post by randomhodler84 »

armchairhacker wrote: post #12
nonrandomstring wrote: post #3

"Let’s Encrypt is currently used by more than 280 million websites, issuing between two and three million certificates per day. I often think about how we got here, looking for some nugget of wisdom that might be useful to others." I guess it's keep trying. Keep patiently explaining, educating and building. I remember people saying "You'll never be able to topple the certs racket" - and here we are... in a age where…

What alternatives are there to get cheap easy SSL certificates? Let's Encrypt has no competition because Let's Encrypt needs no competition: it works, it's cheap, and competitors can't really provide any advantages for its target audience (mostly people who just want a cert).

It’s not even a competition. Every customer increases costs to provide the service. More people handling the load of signing keys means less cost for a public service. It’s a shared ecosystem of trust. Yes, you can make the argument that too many CAs is untrustworthy, I would agree. But there is a reliability and availability argument, both security objectives, to having alternatives. There is probably an optimal point between redundancy and too many cooks.

Re: Let’s Encrypt Receives the Levchin Prize for Real-World Cryptography

#22

Post by profmonocle »

tialaramex wrote: post #6
bombcar wrote: post #2

The main thing I'm thankful for Let's Encrypt for is breaking the idea that an SSL-secured website is somehow magically less likely to be phishing or even anything but claiming it's the data from the domain you connected to, without changes. Mainly this was propagated by EV cert sellers, but it was all kinda silly.

Let's Encrypt's own community forums get posts every day from people saying, wait, I got scammed/ phished/ whatever on this site, it has your certificate, shouldn't you shut it down? They do have a page to link those enquiries to, explaining the policy (and indeed they even have standard legal briefs because periodically lawyers get the same idea and a court has to be told why that's wrong). It would be interesting t…

It's frustrating because certificate revocation doesn't even really work, since most browsers don't check for it due to the various performance/privacy issues it causes. (OCSP stapling doesn't help here, because a scammer just won't use it.)

At best Let's Encrypt could revoke the cert and block them from getting a new one, but then the scam site is still good to go for 90 days. I doubt most phishing sites even last that long.

What does work, and relatively quickly, is having the web host shut down the site (basically instant), having the registrar revoke the domain (takes effect as soon as DNS caches start expiring) or adding it to the various phishing site lists used by browsers. (Not sure how often those update, I assume at least daily.)

I hope that the misguided people asking LE to shut down the domain are at least trying to contact the web host, registrar, and the safe browsing list people before hassling the (mostly volunteer) folks on the LE forums.

Re: Let’s Encrypt Receives the Levchin Prize for Real-World Cryptography

#23

Post by profmonocle »

bombcar wrote: post #2

The main thing I'm thankful for Let's Encrypt for is breaking the idea that an SSL-secured website is somehow magically less likely to be phishing or even anything but claiming it's the data from the domain you connected to, without changes. Mainly this was propagated by EV cert sellers, but it was all kinda silly.

> Mainly this was propagated by EV cert sellers, but it was all kinda silly.

I feel like it really started back in early(ish) days of online shopping. I remember "never enter your credit card details without looking for the lock icon" being drilled into people.

EV certs definitely took this idea farther, especially as domain-validated certs became more common & cheaper.

Re: Let’s Encrypt Receives the Levchin Prize for Real-World Cryptography

#25

Post by tptacek »

gunapologist99 wrote: post #8
lukeschlather wrote: post #4

Earlier quoted context omitted.

That idea is unfortunately alive and well. Many organizations require it, much like they require 90-day password rotation and other questionable security standards.

Ironic that 90 day certificate rotation makes even less sense than 90 day password rotation.

Password rotation discourages password automation (password managers). Certificate rotation encourages (requires, really) certificate automation.

Re: Let’s Encrypt Receives the Levchin Prize for Real-World Cryptography

#26

Post by xvector »

randomhodler84 wrote: post #20

Lets encrypt is a true marvel that blessed the world with easy quick automatable webpki and identity. The world is exponentially more private and secure from their actions. One of the most critical public services in the world.

And it's all free, which is simply beautiful!

Re: Let’s Encrypt Receives the Levchin Prize for Real-World Cryptography

#28

Post by jfim »

tptacek wrote: post #25
gunapologist99 wrote: post #8

Earlier quoted context omitted.

Ironic that 90 day certificate rotation makes even less sense than 90 day password rotation.

Password rotation discourages password automation (password managers). Certificate rotation encourages (requires, really) certificate automation.

Wouldn't it be the opposite? If I had to rotate passwords frequently I'd want to use a password manager that could handle it for me.

Re: Let’s Encrypt Receives the Levchin Prize for Real-World Cryptography

#29

Post by tptacek »

jfim wrote: post #28
tptacek wrote: post #25

Earlier quoted context omitted.

Password rotation discourages password automation (password managers). Certificate rotation encourages (requires, really) certificate automation.

Wouldn't it be the opposite? If I had to rotate passwords frequently I'd want to use a password manager that could handle it for me.

There's no standard way for websites to rotate passwords through password managers.

Re: Let’s Encrypt Receives the Levchin Prize for Real-World Cryptography

#30

Post by hashhar »

tptacek wrote: post #29
jfim wrote: post #28

Earlier quoted context omitted.

Wouldn't it be the opposite? If I had to rotate passwords frequently I'd want to use a password manager that could handle it for me.

There's no standard way for websites to rotate passwords through password managers.

There is a way to indicate the URI to visit for change-password but not about how to interact with the document at that URI.

See `change-password` under https://en.wikipedia.org/wiki/Well-known_URI.

Post reply on HN