Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A Year-End Letter from our Executive Director

letsencrypt.org

Post reply on HN
Print view View original

71–80 of 155 posts

Re: A Year-End Letter from our Executive Director

#71

Post by rainsford »

iuafhiuah wrote: post #43

I am glad it looks like the IETF ACME specification only addresses the HTTP-01 challenge. I really would like to see improvements made to the DNS-01 challenge before it's ratified, namely, let us publish a public key to a TXT record and use the private key to sign the renewal request. Then I can revoke certbot's access to my DNS records and stop hacking the `.well-known` path.

I'll admit I haven't spent a ton of time thinking through all the implications, but that proposal seems like it comes with some significant security tradeoffs. In particular, you'd lose the ability to prove you control the domain name at the time of certificate renewal. Instead, the key pair approach shows you controlled the DNS records for the domain at some point and your entry has yet to be deleted. From the certificate issuing standpoint, that seems like a much weaker security guarantee. Certbot's access to your DNS records does mean you have to protect those credentials, but the overall requirement seems like a feature rather than a bug.

Re: A Year-End Letter from our Executive Director

#72

Post by vladd »

doublerabbit wrote: post #53
ethbr0 wrote: post #13

Earlier quoted context omitted.

Indeed! It's how security should work, and should be the default dual-goal of any piece of security software: provide as much security as possible to as many people as possible.

Quoted post unavailable.

I believe you get downvotes because you think by analogy rather than by reasoning. Not having that big corporation example doesn't negate Let's Encrypt's value proposition (and the improvement they brought compared with the way things were done before).

Also you're mixing security on data transportation with security of data at rest. Both are important but there are different solutions to each.

Re: A Year-End Letter from our Executive Director

#73

Post by Cogito »

NavinF wrote: post #49
bombcar wrote: post #48

Earlier quoted context omitted.

Nobody offers more than a year now. It’s annoying. So many old devices still need to be supported and can’t automatically update.

If these devices have internet access they can auto renew. If they don't, they don't need a cert signed by a public CA.

I partly agree with you, however it's possible for devices to have limited access to the internet, or even no direct access but still be accessible to devices that are on the internet.

If I have a smart device at home I may put it on a network that has no outgoing access to the internet, but it would still be nice to be able to connect to it with a web browser without getting angry expired certificate warnings.

It's not the worst problem to have, and I don't think it's easy to fix, but it's still annoying.

Re: A Year-End Letter from our Executive Director

#74

Post by shepherdjerred »

doublerabbit wrote: post #53
ethbr0 wrote: post #13

Earlier quoted context omitted.

Indeed! It's how security should work, and should be the default dual-goal of any piece of security software: provide as much security as possible to as many people as possible.

Quoted post unavailable.

> No thanks. Why doesn't Google, Microsoft, HackerNews use LetsEncrypt?

Why does Bill Gates use Windows? There must be some fatal flaw in macOS if so many are choosing other operating systems!

Re: A Year-End Letter from our Executive Director

#75

Post by wtetzner »

ay wrote: post #68

In all the excitement (I too think that they did massive strides in usability of https to the masses), nobody mentions of systems-level consequences of a single entity holding the keys to 300000000 servers on the internet. They’re now in a “don’t be evil” phase. But the people move on, change, etc. And the companies get sold, rogue, bankrupt… I realize an org itself won’t fancy ponder its inevitable deviation from to…

Just curious what you think the consequences could be? Worst case scenario people would need to find a new CA the next time they need a certificate, right?

Re: A Year-End Letter from our Executive Director

#76

Post by rakoo »

candiddevmike wrote: post #20

I don't understand why Let's Encrypt is OK but DANE isn't. They both use DNS to authenticate certificates, why not cut out the middleman?

Let's encryt is a protocol, ACME, that can be implemented by any number of independent actors. Yes, it takes time, energy and money, but it is doable. And if it is possible to switch away from a bad actor, there is more incentive to not being a bad actor.

DANE relies on the DNS being end-to-end secure, which all boils down to the root being secure. It's extremely centralized in a way that is just diammetrally opposed to how the Internet is designed.

Re: A Year-End Letter from our Executive Director

#77

Post by spicybright »

doublerabbit wrote: post #53
ethbr0 wrote: post #13

Earlier quoted context omitted.

Indeed! It's how security should work, and should be the default dual-goal of any piece of security software: provide as much security as possible to as many people as possible.

Quoted post unavailable.

So for one, if you're looking for an actual answer, dial it down a few notches. Your post is 18 minutes old as of me writing and you're already boasting about a lack of replies.

Two, you're likely misunderstanding the purpose of SSL and Let's Encrypt. It's not to protect you against the site you're talking to, it's to prevent man in the middle attacks on the way. It ensures you can't walk into a starbucks for an hour and walk away with dozens of facebook logins.

Lastly, the big players don't use Let's Encrypt for reliability and customer service purposes. If you run a blog and your cert screws up, the 3 people visitng your site that week will have to click a few extra buttons to get in.

If you're a microsoft, that can mean thousands if not millions of users hitting this wall they expect not to have, leading to huge costs for customer support and occassionally deeper issues updating certificates. Exactly the same reason Bank of America doesn't use godaddy.com for their domain name.

Before Let's Encrypt, certs cost money from certificate authorities, so not many smaller companies would bother. Now it's streamlined enough that browsers throw scary warnings if you don't have it, which is a massive improvement for everyone using the web.

Re: A Year-End Letter from our Executive Director

#78

Post by 0goel0 »

cube00 wrote: post #45
Gigachad wrote: post #40

Earlier quoted context omitted.

They seem a whole lot less bloated than Wikipedia as well. Given that something around 3% of donations to Wikipedia actually go to the website, they'll be fine with less donations despite what their nag popups suggest.

I stopped donating to Wikipedia after the size of their cash reserves were revealed. I get that's designed to protect themselves for the long term and it sounds like they've made it so they don't need my money for now, at least not at the expense of other projects that don't have such cash reserves like Let's Encrypt.

> stopped donating to Wikipedia after the size of their cash reserves were revealed.

After I read your comment, I thought they had 10x annual expenses or something but really they have 18 months of runway. That's not that long IMO.

https://www.washingtonpost.com/news/the-intersect/wp/2015/12...

Re: A Year-End Letter from our Executive Director

#79

Post by wtetzner »

doublerabbit wrote: post #53
ethbr0 wrote: post #13

Earlier quoted context omitted.

Indeed! It's how security should work, and should be the default dual-goal of any piece of security software: provide as much security as possible to as many people as possible.

Quoted post unavailable.

> Just takes one bad actor for LetsEncrypt to swallow your site whole.

What do you mean by this?

Re: A Year-End Letter from our Executive Director

#80

Post by ipaddr »

TillE wrote: post #63
bogwog wrote: post #58

Earlier quoted context omitted.

Ok I get not wanting to pick on the guy, but is that really reasonable? Engineering is about solving problems by designing/implementing systems. The more you know about the system(s) you're working with, the better the solutions you can build. Even if you're "just" working at a high level and maximally specialized to a single niche, not knowing how the underlying parts work will really limit you. Pick the brain of an…

Right obviously very few people will be deep experts on the nitty gritty details of any particular thing, but it's weird to work with computers and not have a broad high-level understanding of something as crucial as TLS and PKI.

Not understanding something is to be expected but being proud you don't have to goes against the core of what a programmer is.. curious.
Post reply on HN