Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

10 Years of Let's Encrypt

letsencrypt.org

Post reply on HN
Print view View original

101–110 of 361 posts

Re: 10 Years of Let's Encrypt

#101

Post by bifurcation »

charlesbarbier wrote: post #93
jsheard wrote: post #46

Earlier quoted context omitted.

It's not like Let's Encrypt is the only game in town, Actalis in Italy provides free ACME certs too if you'd prefer to keep things in Europe.

Not sure if there is a point to "keep things in Europe" when it come to certificate authority. - LetsEncrypt don't have the private key tied to your certificate - Any of the Certificate Authorities could potentially emit unauthorized certificate Your only protection for all of these problems is HPKP. If you prefer to keep things in Europe, keep that pinned private key in Europe, but the rest doesn't matter. That said…

Just to clear up one point -- Let's Encrypt did not at all force ACME on the industry. We deliberately took it to the IETF so that we could get input from more parts of the industry (including some major refactors!). Instead of pressure from Let's Encrypt, I would attribute its success to the open process of the IETF, the awesome open-source community that made great ACME software (shoutout to Matt and Caddy!), and the resulting pressure on CAs for a better user experience from users and customers.

Re: 10 Years of Let's Encrypt

#102

Post by joshstrange »

I still remember the original announcement around LE and thought "Great idea, no idea if they'll be able to get buy-in from browsers/etc", now I use it on all my self-hosted sites and will probably be transitioning my employer over to it when we switch to automated renewal sometime next year.

LE has been an amazing resource and every time I setup a new website and get a LE cert I smile. Especially after having lived/experienced the pain that was SSL/TLS before LE.

Re: 10 Years of Let's Encrypt

#103

Post by charcircuit »

foresto wrote: post #90
Analemma_ wrote: post #19

Earlier quoted context omitted.

I've seen people complain that Let's Encrypt is so easy that it's enabling the forced phaseout of long-lived certificates and unencrypted HTTP. I sort of understand this, although it does feel like going "bcrypt is so easy to use it's enabling standards agencies to force me to use something newer than MD5". Like, yeah, once the secure way is sufficiently easy to use, we can then push everyone off the insecure way; th…

I can understand this in in certain contexts, such as a site that exists solely to post public information of no value to an attacker. A local volunteer group that posts their event schedule to the web were compelled to take on the burden of https just to keep their site from being labeled as a potential threat. They don't have an IT department. They aren't tech people. The change multiplied the hassles of maintainin…

This is why more and more organizations get away with only having social media pages where they don't have to worry about security or other technical issues.

Re: 10 Years of Let's Encrypt

#104

Post by ok123456 »

tptacek wrote: post #98
ok123456 wrote: post #85

Earlier quoted context omitted.

Yes. And I remember sniffing Facebook traffic in clear text in 2011. The fact remains that it was considered a significant engineering problem for them to deploy it. It was a "best practice" that most people rolled their eyes at. Most users and system owners didn't care unless money was being transacted. Between Snowden and ISPs injecting content into pages, the consensus changed.

The consensus obviously changed. It's just that it changed years before the Snowden leaks.

The adversarial nature of the US Government changed the threat model, and it moved from a "nice to have" best practice to a business necessity. They were caught red-handed undermining the privacy of US citizens by systematically exploiting infrastructure vulnerabilities, for example, in Google, where messages flowed in clear text within nominally trusted contexts.

Re: 10 Years of Let's Encrypt

#105

Post by charcircuit »

unethical_ban wrote: post #58
greyface- wrote: post #17

New baseline expectation that web traffic will be encrypted on the wire: very good! New de-facto requirement that you need to receive the blessing of a CA to make use of basic web platform features... not so good.

Kinda hear you, but DNS is a defacto requirement as well. Neither DNS (common TLDs) nor any of the major cert vendors I'm aware of ask you your site's business before issuing.

>ask you your site's business before issuing.

Because they want your money. If they ask you after they get to keep your money.

Re: 10 Years of Let's Encrypt

#106

Post by hinkley »

The thing that has made me feel the oldest this week is that someone I used to mentor posted a holiday pictures with visible wrinkles. If people you think are young look old, then buddy, check the mirror.

But this is a close second. 10 years? That can't be right. Even accounting for Covid Time Dialation.

Re: 10 Years of Let's Encrypt

#107

Post by monerozcash »

wnevets wrote: post #68
RonanSoleste wrote: post #59

Earlier quoted context omitted.

When you request an EV. They call you by the phone number that you give to ask if you requested a certificate. That was the complete extend of the validation. I could be a scammer with a specificity designed domain name and they would just accept it, no questions asked.

> In addition to all of the authentication steps CAs take for DV and OV certificates, EV certificates require vetting of the business organization’s operational existence, physical address and a telephone call to verify the employment status of the requestor. [1] [1] https://www.digicert.com/difference-between-dv-ov-and-ev-ssl... Tying a phone number to a physical address and company is a lot more useful than just pr…

It was easy to provide the information for an existing business you're completely unrelated to. Reliably verifying that a person actually represents a company isn't possible in most of the world.

Re: 10 Years of Let's Encrypt

#108

Post by letsgetreal »

Let's Encrypt allows anyone to have secure https communication, sure, but it doesn't address the question of website authenticity. I groan when I'm on an e-commerce site and I click on the browser URL lock icon and see a Let's Encrypt certificate because frankly anyone can create one for no cost and I don't know if it's the real website or if I made a URL typo. Say what you will about the expensive cert providers, but it's reassuring when you see DigiCert or Sectigo - with a company name and the address of the head office.

Re: 10 Years of Let's Encrypt

#109

Post by foresto »

charcircuit wrote: post #103
foresto wrote: post #90

Earlier quoted context omitted.

I can understand this in in certain contexts, such as a site that exists solely to post public information of no value to an attacker. A local volunteer group that posts their event schedule to the web were compelled to take on the burden of https just to keep their site from being labeled as a potential threat. They don't have an IT department. They aren't tech people. The change multiplied the hassles of maintainin…

This is why more and more organizations get away with only having social media pages where they don't have to worry about security or other technical issues.

Unfortunately, placing the information on a social media page burdens the people seeking it with either submitting to the social media site's policies and practices, or else not having access to it. This is not a good substitute.

It also contributes to the centralization of the web, placing more information under the control of large gatekeepers, and as a side effect, giving those gatekeepers even more influence.

Re: 10 Years of Let's Encrypt

#110

Post by par »

asim wrote: post #36

As a sysadmin in the 2007-2011 timeframe I literally used openssl to generate csrs, went to godaddy to purchase SSL certificates and then manually deployed them to servers. Man what a world of change. Let's encrypt is one the best services we've had on the internet. I wish we had more things like this.

i was doing this until a couple years back when a friend told me about LetsEncrypt! It's like magic!!
Post reply on HN