Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

10 Years of Let's Encrypt

letsencrypt.org

Post reply on HN
Print view View original

61–70 of 361 posts

Re: 10 Years of Let's Encrypt

#61

Post by 0x0 »

SirMaster wrote: post #29
Aardwolf wrote: post #3

Earlier quoted context omitted.

Agreed! What were we using before Let's Encrypt again? Maybe just plain HTTP

I was using StartCom StartSSL which was offering free 1 year certificates at least for my personal sites.

They were great in the beginning, and then when you issued a few more certs than they liked you were asked to pony up some $$$, and then when you did that and actually "verified" who you were on a personal international phone call, you got a grace, and then issued a few more, they decided they didn't like you so they would randomly reject your renewals close to the expiration date, and then they got bought out by some scummy foreign outfit which apparently caused the entire CA to be de-listed as untrustworthy in all major browsers. Quite the ride.

Also, the only website I've ever encountered that actually used the HTML tag.

Re: 10 Years of Let's Encrypt

#62

Post by nottorp »

mschuster91 wrote: post #35
Analemma_ wrote: post #19

Earlier quoted context omitted.

I've seen people complain that Let's Encrypt is so easy that it's enabling the forced phaseout of long-lived certificates and unencrypted HTTP. I sort of understand this, although it does feel like going "bcrypt is so easy to use it's enabling standards agencies to force me to use something newer than MD5". Like, yeah, once the secure way is sufficiently easy to use, we can then push everyone off the insecure way; th…

> Like, yeah, once the secure way is sufficiently easy to use, we can then push everyone off the insecure way; that's how it's supposed to work. The problem is that this requires work and validation, which no beancounter ever plans for. And the underlings have to do the work, but don't get extra time, so it has to be crammed in, condensing the workday even more. For hobbyist projects it's even worse. That is why peop…

> but personal blogs and the likes?

Yep, the result of the current security hysteria/theater is it makes it increasingly difficult to maintain an independent web presence.

Yes, I know, you can just use Cloudflare and depend on it...

Re: 10 Years of Let's Encrypt

#64

Post by Uvix »

RonanSoleste wrote: post #59
wnevets wrote: post #52

Earlier quoted context omitted.

> Call me old-school, but I really liked how EV certs looked in the browser. I agree, making EV Certs visually more important makes sense to people who know what it means and what it doesn't. Too bad they never made it an optional setting.

When you request an EV. They call you by the phone number that you give to ask if you requested a certificate. That was the complete extend of the validation. I could be a scammer with a specificity designed domain name and they would just accept it, no questions asked.

Depends on the registrar. Globalsign required the phone number to be one publicly listed for the company in some business registry (I forget exactly which one), so it had to be someone in our main corporate office who'd deal with them on the phone.

Re: 10 Years of Let's Encrypt

#65

Post by nvader »

hulitu wrote: post #18

> 10 Years of Let's Encrypt Aren't they only 45 days [1] old ? [1] https://letsencrypt.org/2025/12/02/from-90-to-45

Wow, this might be the push I needed to automate certificate renewal on my personal website [0].

Manually clicking `make renew-cert` was barely tolerable every quarter, but if I have to do it twice as frequently I may as well ask an LLM to figure it out on my behalf.

[0]: https://danverbraganza.com

Re: 10 Years of Let's Encrypt

#66

Post by ok123456 »

Snowden was the other big reason that TLS became the de facto standard for every site.

Prior to that, the consensus was that you only really needed TLS if you were dealing with money and wasn't worth the hassle otherwise. You could sniff traffic from Facebook and Twitter easily.

I remember listening to a talk given by an IRS investigator in around 2008 about how they were able to do a sting and shutdown illegal internet casinos. They collected a good bulk of that evidence from clear-text packet captures of gambling sessions and messages. He preemptively answered the question of whether encryption was a hurdle, by saying no one used it.

Re: 10 Years of Let's Encrypt

#67

Post by stego-tech »

Let’s Encrypt is something so amazingly valuable that I was certain it’d be killed dead within a year to prop up the existing SSL cert business.

Congrats on a decade, ya’ll, here’s to many, many more in securing the free internet.

Re: 10 Years of Let's Encrypt

#68

Post by wnevets »

RonanSoleste wrote: post #59
wnevets wrote: post #52

Earlier quoted context omitted.

> Call me old-school, but I really liked how EV certs looked in the browser. I agree, making EV Certs visually more important makes sense to people who know what it means and what it doesn't. Too bad they never made it an optional setting.

When you request an EV. They call you by the phone number that you give to ask if you requested a certificate. That was the complete extend of the validation. I could be a scammer with a specificity designed domain name and they would just accept it, no questions asked.

> In addition to all of the authentication steps CAs take for DV and OV certificates, EV certificates require vetting of the business organization’s operational existence, physical address and a telephone call to verify the employment status of the requestor. [1]

[1] https://www.digicert.com/difference-between-dv-ov-and-ev-ssl...

Tying a phone number to a physical address and company is a lot more useful than just proof of control over a domain. Of course its not 100% fool proof and depends on the quality of the CA but still very useful.

Re: 10 Years of Let's Encrypt

#69

Post by anonymars »

xxmarkuski wrote: post #48
jjice wrote: post #5

Let's Encrypt was _huge_ in making it's absurd to not have TLS and now we (I, at least) take it for granted because it's just the baseline for any website I build. Incredible, free service that helped make the web a more secure place. What a wonderful service - thank you to the entire team. The CEO at my last company (2022) refused to use Let's Encrypt because "it looked cheap to customers". That is absurd to me beca…

I have heard, but do not aggree, that Let‘s Encrypt is risky, because phishing sites use it. It’s implied that other CAs do checks against it.

I will say, I have never before this season seen so many seemingly-legit fake web stores. All with their little lock icons in the address bar. I assume LLMs helped kick it into overdrive too
Post reply on HN