241–250 of 404 posts
Earlier quoted context omitted.
They could, but if the branch didn’t follow these laws, the main US branch would still be liable.
Just close down completely in the US and move to the EU
Earlier quoted context omitted.
> One, in a democracy, is accountable to adults in the same jurisdiction Or so they say. How's that been working out in practice?
Pretty well, in my experience.
I guess one doing well enough can be oblivious to all this...
Earlier quoted context omitted.
OFAC regulates commerce, not speech. Let's Encrypt is not doing "business", they're operating a free informational service. Lots of organizations interpret any information exchange as subject to OFAC regulation, and you and Let's Encrypt have good company in this interpretation, but I think it's unnecessarily ceding ground.
The government may use as wide of an interpretation of commerce as they can get away with. We've seen this happen before [0]. Sure, Let's Encrypt isn't taking money from the entities they offer certificates to. But the OFAC desk jockey assigned to that case only has to concoct some sufficiently plausible-sounding trail of money connecting the backing 501(c)3 and a sanctioned entity in order to levy penalties, and the…
Earlier quoted context omitted.
We could, and should, switch to DANE. Or else, switch to how X.509 was supposed to be used, with each country running a CA for their nationals.
I trust governments much less that a conglomerate of competing corporations. With all the problems with Web PKI, at least the bad actors are getting distrusted, and this provides a very strong enforcement on the rest. And Certificate Transparency makes sure the mis-issuance would be caught. It is not perfect by any means, but things are getting better. With DANE (or other country-issued certificates), every governmen…
Let's not create a world wide PKI based on a political ideology.
> country-issued certificates [...] every government will absolutely double-issue certificates
This is such a strange argument. If you register a .ru domain, do you really think you are safe should the Russian intelligence services ask for a valid certificate? Controlling the actual domain, they could issue ask many domain validated certificates as they wish.
The problem with our current SSL PKI, as so very many people have pointed out over the years, is that any CA is allowed to issue valid certificates for any domain name. There have been proposals to use X.509 extensions to remedy this, but they have seen lesser real world usage than the various certificate revocation schemes, which is very close to zero already.
If there was no way for a Russian CA to issue certificates for .us domains, real world security would improve. A lot. And the other way around, of course.
Feel free to s/Russian/Chinese/ in the above argument or whatever tickles your geopolitical fancies. The argument still stands.
Domain registries decide who owns what domain. That is their literal role. You would think that asserting this ownership cryptographically would be a no-brainer in 2026. Yet we have this discussion over and over again. There are many people whose income quite literally depend on the status quo of our global SSL PKI, which coincidentally also offers no end of possibilities for the various intelligence services around the world.
The next time someone tries to scare you with that governments or intelligence services control DNS and therefore it would be crazy to limit issuance of certificates to them, take a look where they have contracts.
Let's Encrypt’s mission is to create a more secure and privacy-respecting web, except for people residing in countries with the most need for a more secure and privacy-respecting web. Sure, that's great. That said, pretty sure this is stems from the insane US legal requirement to not export SSL technology to enemy countries. I'm sure some of y'all are old enough to remember when web browsers came in "international fr…
Let's Encrypt continues to be available to almost every vulnerable population in the world, including those that need it most. I say almost as I'm hesitant to speak in absolutes regarding a topic as complex as this. Most of our sanctions-related blocks apply only to the governments of certain sanctioned countries, not their general population. This subscriber agreement update was intended to better reflect our legal…
Earlier quoted context omitted.
The headline is more « US law is batshit and extends well beyond its borders with real world consequences »
This is not specific to US law ...
Should the US wish to sanction the Hague, somewhat famous for its international court of justice, they would absolutely go after ISRG and it would not be enough for them to sever the ties of the hypothetical Let's Encrypt Europe. That would not be legal or last least highly questionable in most other democratic countries.
Earlier quoted context omitted.
Let's Encrypt continues to be available to almost every vulnerable population in the world, including those that need it most. I say almost as I'm hesitant to speak in absolutes regarding a topic as complex as this. Most of our sanctions-related blocks apply only to the governments of certain sanctioned countries, not their general population. This subscriber agreement update was intended to better reflect our legal…
When you say “our legal requirements” do you mean requirements LE imposes in its agreements or requires imposed on LE by governments?
Earlier quoted context omitted.
What constitutes the "vast majority" ? Periodically I check mine, and I sometimes have reason to check others, I no longer run my own log auditing (I did when I worked somewhere else because it was close to my main field of interest) but other people do.
How can you check other people's certs? How do you know whether a cert issued is authorized by them or not? The only one who can check for maliciously published certs is the entity authorized to request them. I think most companies are happy when they manage to have valid, not expired certs and do not care too much about making sure there are not too many of them. You are right that if the state would start issuing m…
In these cases it's really obvious if there's anything weird going on. You're correct that we can't know, as a third party why there's something weird. Maybe the server was being replaced and the new server just installed an ACME client and got itself a new cert last Tuesday even though the previous one doesn't expire for weeks. But if there was nothing we don't even need to ask anybody what's up - nothing is.
IMNSHO The statistics don't really work for targeted attacks. The odds you'll get away with it are unknowable and you only have to get unlucky once.
Earlier quoted context omitted.
It shouldn't be located in Europe (because, as you said, US minions are no better than the US itself). Instead it should move to a neutral country, somewhere like Singapore or Uruguay.
Suddenly the idea of having a CA hosted in space on a satellite issuing certs seems like a good idea.
Let's Encrypt’s mission is to create a more secure and privacy-respecting web, except for people residing in countries with the most need for a more secure and privacy-respecting web. Sure, that's great. That said, pretty sure this is stems from the insane US legal requirement to not export SSL technology to enemy countries. I'm sure some of y'all are old enough to remember when web browsers came in "international fr…
http://www.cypherspace.org/adam/uk-shirt.html
A t-shirt with a Perl script that implemented RSA encryption strong enough to be technically illegal to export from the US.
(I must sadly admit to being too cowardly/sensible to have taken that shirt to the US in the late 90s...)