Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Let's Encrypt bans certificate usage in any US sanctioned territory [pdf]

letsencrypt.org

Post reply on HN
Print view View original

51–60 of 404 posts

Re: Let's Encrypt bans certificate usage in any US sanctioned territory [pdf]

#51

Post by theamk »

Parodper wrote: post #46
MarleTangible wrote: post #37

Earlier quoted context omitted.

I always saw it as a trust-chain and think that anyone is welcomed to create a root certificate and distribute it to whomever trusts them. Most simple services may not need TLS, but with the ISPs eavesdropping on our communication, a form of secure communication is required and the currently best solution we have requires a trust-chain to be built.

We could, and should, switch to DANE. Or else, switch to how X.509 was supposed to be used, with each country running a CA for their nationals.

I trust governments much less that a conglomerate of competing corporations.

With all the problems with Web PKI, at least the bad actors are getting distrusted, and this provides a very strong enforcement on the rest. And Certificate Transparency makes sure the mis-issuance would be caught. It is not perfect by any means, but things are getting better.

With DANE (or other country-issued certificates), every government will absolutely double-issue certificates to police, secret service and friends of goverment, and no one will have any recourse. (In the past I'd say that only countries like Russia would do it.. but with today's climate, I am sure both US and many European countries will do that too)

Re: Let's Encrypt bans certificate usage in any US sanctioned territory [pdf]

#53

Post by account42 »

palmotea wrote: post #48
axiologist wrote: post #35

This somehow confirms my gut feeling that digital certificates are mainly a means to enforce exclusion on behalf of the certificate authority ownership. It is a tool to prevent people from taking full ownership and control of whatever is affected by digital certificates, be it software, firmware, hardware, or as in this case SSL/TLS. That's digital tyranny in disguise.

> This somehow confirms my gut feeling that digital certificates are mainly a means to enforce exclusion on behalf of the certificate authority ownership. It is a tool to prevent people from taking full ownership and control of whatever is affected by digital certificates, be it software, firmware, hardware, or as in this case SSL/TLS. That's digital tyranny in disguise. I think the "digital tyranny" is a side effect…

You could that with a much saner approach like DANE.

Re: Let's Encrypt bans certificate usage in any US sanctioned territory [pdf]

#54

Post by account42 »

MarleTangible wrote: post #37
axiologist wrote: post #35

This somehow confirms my gut feeling that digital certificates are mainly a means to enforce exclusion on behalf of the certificate authority ownership. It is a tool to prevent people from taking full ownership and control of whatever is affected by digital certificates, be it software, firmware, hardware, or as in this case SSL/TLS. That's digital tyranny in disguise.

I always saw it as a trust-chain and think that anyone is welcomed to create a root certificate and distribute it to whomever trusts them. Most simple services may not need TLS, but with the ISPs eavesdropping on our communication, a form of secure communication is required and the currently best solution we have requires a trust-chain to be built.

Do we also need to put all our letters into strongboxes before we send them?

Maybe we should have solve the ISP snooping problem by making that illegal instead.

Re: Let's Encrypt bans certificate usage in any US sanctioned territory [pdf]

#55

Post by account42 »

theamk wrote: post #51
Parodper wrote: post #46

Earlier quoted context omitted.

We could, and should, switch to DANE. Or else, switch to how X.509 was supposed to be used, with each country running a CA for their nationals.

I trust governments much less that a conglomerate of competing corporations. With all the problems with Web PKI, at least the bad actors are getting distrusted, and this provides a very strong enforcement on the rest. And Certificate Transparency makes sure the mis-issuance would be caught. It is not perfect by any means, but things are getting better. With DANE (or other country-issued certificates), every governmen…

Pretty much any big government has a CA they can exert direct control over whenever needed.

Re: Let's Encrypt bans certificate usage in any US sanctioned territory [pdf]

#56

Post by account42 »

Panzerschrek wrote: post #13

Does it mean that russian/iranian web-sites using letsencrypt stop working and need to change their certificate provider?

Depending on how you are supposed to read "You agree to use Let’s Encrypt Certificates and any services provided by or on behalf of ISRG in compliance with applicable U.S. export control and sanctions laws and regulations." it could mean that you are not even allowed to use LE certificate to provide services to sanctioned entities as a random non-US company/person.

Re: Let's Encrypt bans certificate usage in any US sanctioned territory [pdf]

#58

Post by theamk »

account42 wrote: post #55
theamk wrote: post #51

Earlier quoted context omitted.

I trust governments much less that a conglomerate of competing corporations. With all the problems with Web PKI, at least the bad actors are getting distrusted, and this provides a very strong enforcement on the rest. And Certificate Transparency makes sure the mis-issuance would be caught. It is not perfect by any means, but things are getting better. With DANE (or other country-issued certificates), every governmen…

Pretty much any big government has a CA they can exert direct control over whenever needed.

Maybe, but then can only do it once. Then they get caught, and their CA is distrusted. See Diginotar [0] for example.

And things only gotten better since - we now have CT logs, and browsers require them, so any mis-issuance can be detected automatically, by any interested third party.

If we go to DANE, we lose this all. "Oops, our CT uploader process failed, we will fix Real Soon(tm) we promise" - and what are browsers going to do? Distrust the entire country?

[0] https://blog.mozilla.org/security/2011/09/02/diginotar-remov...

Re: Let's Encrypt bans certificate usage in any US sanctioned territory [pdf]

#59

Post by franga2000 »

account42 wrote: post #53
palmotea wrote: post #48

Earlier quoted context omitted.

> This somehow confirms my gut feeling that digital certificates are mainly a means to enforce exclusion on behalf of the certificate authority ownership. It is a tool to prevent people from taking full ownership and control of whatever is affected by digital certificates, be it software, firmware, hardware, or as in this case SSL/TLS. That's digital tyranny in disguise. I think the "digital tyranny" is a side effect…

You could that with a much saner approach like DANE.

Not back when SSL and the PKI ecosystem was developed.

Re: Let's Encrypt bans certificate usage in any US sanctioned territory [pdf]

#60

Post by theamk »

account42 wrote: post #54
MarleTangible wrote: post #37

Earlier quoted context omitted.

I always saw it as a trust-chain and think that anyone is welcomed to create a root certificate and distribute it to whomever trusts them. Most simple services may not need TLS, but with the ISPs eavesdropping on our communication, a form of secure communication is required and the currently best solution we have requires a trust-chain to be built.

Do we also need to put all our letters into strongboxes before we send them? Maybe we should have solve the ISP snooping problem by making that illegal instead.

This just leaves every single public Wifi network - which used to mess with traffic a lot
Post reply on HN