Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

10 Years of Let's Encrypt

letsencrypt.org

Post reply on HN
Print view View original

111–120 of 361 posts

Re: 10 Years of Let's Encrypt

#111

Post by brians »

RonanSoleste wrote: post #59
wnevets wrote: post #52

Earlier quoted context omitted.

> Call me old-school, but I really liked how EV certs looked in the browser. I agree, making EV Certs visually more important makes sense to people who know what it means and what it doesn't. Too bad they never made it an optional setting.

When you request an EV. They call you by the phone number that you give to ask if you requested a certificate. That was the complete extend of the validation. I could be a scammer with a specificity designed domain name and they would just accept it, no questions asked.

Having run an EV issuing practice… they were required to contact you at a D&B listed number or address.

Re: 10 Years of Let's Encrypt

#112

Post by tptacek »

letsgetreal wrote: post #108

Let's Encrypt allows anyone to have secure https communication, sure, but it doesn't address the question of website authenticity. I groan when I'm on an e-commerce site and I click on the browser URL lock icon and see a Let's Encrypt certificate because frankly anyone can create one for no cost and I don't know if it's the real website or if I made a URL typo. Say what you will about the expensive cert providers, bu…

It was never a reasonable goal of the WebPKI to authenticate entities; only to help establish end-to-end encryption between unrelated parties on the Internet. The WebPKI can ensure you're talking to whoever controls `ycombinator.com`, but it has to be up to some other layer of the security stack to decide whether you want to be talking to `ycombinator.com`. (This is in fact part of the logic behind FIDO2 and phishing-proof authentication).

Re: 10 Years of Let's Encrypt

#113

Post by traceroute66 »

cjaybo wrote: post #50
traceroute66 wrote: post #23

Earlier quoted context omitted.

> has anyone actually commented to you in a negative way about using Let's Encrypt? A friend of mine has had a negative experience insofar as they are working for a small company, using maybe only 15–20 certs and one day they started getting hounded by Let's Encrypt multiple times on the email address they used for ACME registration. Let's Encrcypt were chasing donations and were promptly told where to stick it with…

“They sent a few emails soliciting donations” isn’t exactly a horror story in my experience. Seems hardly worth mentioning!

To be clear, I was merely answering the question posed "has anyone actually commented to you in a negative way about using Let's Encrypt?"

Well, yes, someone actually commented to me in a negative way about using Let's Encrypt ....

Don't shoot the messenger, as they say.

Re: 10 Years of Let's Encrypt

#114

Post by nvader »

bifurcation wrote: post #95
nvader wrote: post #65

Earlier quoted context omitted.

Wow, this might be the push I needed to automate certificate renewal on my personal website [0]. Manually clicking `make renew-cert` was barely tolerable every quarter, but if I have to do it twice as frequently I may as well ask an LLM to figure it out on my behalf. [0]: https://danverbraganza.com

Heh, as I was saying about shorter lifetimes encouraging automation... https://news.ycombinator.com/item?id=46210786

Yep, it's just the push I needed to get off my seat ;)

Re: 10 Years of Let's Encrypt

#115

Post by everfrustrated »

bifurcation wrote: post #92
p2detar wrote: post #41

Earlier quoted context omitted.

Not sure if you're joking or not, but I have to deal with this upcoming change at some point and still haven't read in detail why they decided to do this. Could anyone clarify?

Hi there, ISRG co-founder and current board member here. In brief, shorter lifetimes force people to automate (which, e.g., avoids outages from manual processes) and mitigates the broken state of revocation in the Web PKI. That latter point especially is what I understand to be driving the Web PKI toward ever-shorter lifetimes. I actually remember the discussion we had in ~2014 about what the default certificate life…

With the move to ever shorter certs the risk to letsencrypt having an outage is higher.

It would be nice to read more about what the organization is doing around resilience engineering so we can continue to be confident in depending on it issuing renewals in time.

Do you publish any of this? DR plans? Etc.

I don't mean for this to be a negative - really impressed by LE - but we've had a lot of Cloudflare outages recently and my mind is on vendor reliability & risk at the moment.

Re: 10 Years of Let's Encrypt

#116

Post by traceroute66 »

jfindper wrote: post #49
traceroute66 wrote: post #23

Earlier quoted context omitted.

> has anyone actually commented to you in a negative way about using Let's Encrypt? A friend of mine has had a negative experience insofar as they are working for a small company, using maybe only 15–20 certs and one day they started getting hounded by Let's Encrypt multiple times on the email address they used for ACME registration. Let's Encrcypt were chasing donations and were promptly told where to stick it with…

> one day they started getting hounded by Let's Encrypt multiple times > trying to get a small company to shell out $50k as a "donation". > Even more so if, like Let's Encrypt, you are turning up on the doorstep asking for $50k a pop. Does your friend have anything to corroborate this claim? Perhaps the email with identifying details censored? I have a received an occasional email mentioning donations. They are extre…

All the usual phishing checks were done if that's what you're thinking.

In terms of the actual mail with identifying details removed, I'd have to go back and ask.

I did look before posting here as I thought they had already forwarded it to me, but it was last year, so I have almost certainly cleaned up my Inbox since. I'm not an Inbox hoarder.

Re: 10 Years of Let's Encrypt

#117

Post by schoen »

tptacek wrote: post #73
ok123456 wrote: post #66

Snowden was the other big reason that TLS became the de facto standard for every site. Prior to that, the consensus was that you only really needed TLS if you were dealing with money and wasn't worth the hassle otherwise. You could sniff traffic from Facebook and Twitter easily. I remember listening to a talk given by an IRS investigator in around 2008 about how they were able to do a sting and shutdown illegal inter…

This is a retcon. Facebook rolled out TLS in 2011, 2 years before Snowden, and went TLS-by-default within a month of the Snowden disclosures. Google Mail was TLS-by-default in 2010. TLS was a universal best practice long before 2013 --- by 2010, you'd have gotten a sev:hi vulnerability flagged on your site if you hadn't implemented TLS. SSLLabs was 2009; BEAST was 2011, and was a huge global news story because of how…

I think you're right that this consensus was clearly emerging then (I remember Firesheep in 2010 as another big identifiable contributing factor), but I remember actively asking smaller sites to enable HTTPS in that era, and they would often refuse. So I think Snowden also contributed to the spread of the norm.

It is possible that there's a retcon element, because it's not always clear in my memory exactly what year various sites became more favorably disposed towards the request to use HTTPS. So I could be misremembering some of them as agreeing post-Snowden when they'd actually agreed one year before, or something.

Re: 10 Years of Let's Encrypt

#119

Post by [deleted] »

t1234s wrote: post #87

Lets hope they stay independent and never get acquired by Google or any other large tech company. You can imagine a web where SSL issuance is used as a tool to censor websites. I think most browsers have been made to make standard http sites look malicious to normal users.

[deleted]

Re: 10 Years of Let's Encrypt

#120

Post by charlesbarbier »

bifurcation wrote: post #101
charlesbarbier wrote: post #93

Earlier quoted context omitted.

Not sure if there is a point to "keep things in Europe" when it come to certificate authority. - LetsEncrypt don't have the private key tied to your certificate - Any of the Certificate Authorities could potentially emit unauthorized certificate Your only protection for all of these problems is HPKP. If you prefer to keep things in Europe, keep that pinned private key in Europe, but the rest doesn't matter. That said…

Just to clear up one point -- Let's Encrypt did not at all force ACME on the industry. We deliberately took it to the IETF so that we could get input from more parts of the industry (including some major refactors!). Instead of pressure from Let's Encrypt, I would attribute its success to the open process of the IETF, the awesome open-source community that made great ACME software (shoutout to Matt and Caddy!), and t…

I didn't express myself well but what I meant by force is that by building a standardized to automate way manage certificate, ACME imposed itself and became mandatory.

Previously, most CA had no programmatic way to order certificate, it was all done manually.

As far as I know, the only providers with that would let you automate certificate provisioning at the time where Comodo, GlobalSign and Digicert.

They all had their own quirky API. Just to give you an idea, we ended up selecting GlobalSign at Shopify a few years before LetsEncrypt, and it was this SOAP nightmare: https://www.globalsign.com/en/repository/GlobalSign_Client_A...

At first none of them were warm at the idea of providing an ACME endpoint. I'm assuming part of it is the cost of implementing it but they probably liked the stickiness of their custom APIs too tied to million dollars contracts.

Nowadays they all implement ACME. At some point, they where effectively forced to implement it to acquire new customers and keep their existing base around because nobody would accept poorly designed custom made protocol anymore.

Post reply on HN