Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Let's Encrypt bans certificate usage in any US sanctioned territory [pdf]

letsencrypt.org

Post reply on HN
Print view View original

381–390 of 404 posts

Re: Let's Encrypt bans certificate usage in any US sanctioned territory [pdf]

#381

Post by tptacek »

account42 wrote: post #370
franga2000 wrote: post #350

Earlier quoted context omitted.

Any DNS-based solution needs something like DNSSEC to work. I believe DNSSEC didn't exist yet when HTTPS was being developed and even if it did, it wasn't anywhere near ubiquitous enough. Is it even these days?

That's kind of like saying that any CA-based solution needs something like a root program. Sure, but that would just be part of creating a DANE-like solution. Both the current CA solution and DANE or another hypothetical DNS-based solution are fundamentally similar on a technical level: hierarchical delegation of authorization backed by public key crypto. The main difference is where on the delegation chain you limit…

That's one way to put it. Another way to put it is that the CA system keeps cryptographic trust managed by organizations that can easily be destroyed if they fail, while DANE's trust is practically irrevocable.

Re: Let's Encrypt bans certificate usage in any US sanctioned territory [pdf]

#382

Post by 13415 »

kube-system wrote: post #214
13415 wrote: post #200

Earlier quoted context omitted.

One thing is sure, pinning trust on trust chains down from Root Certificate Authorities is fundamentally incompatible with our notion of trust and an almost absurd idea to start with. Most people using a browser don't even know any person from such an organization nor would or should they have any rational reason to trust them.

> our notion of trust I suspect I may have a different notion of trust than you > Most people using a browser don't even know any person from such an organization nor would or should they have any rational reason to trust them. Back up one step further -- most people using a browser don't understand the problem set we're talking about even exists

As long as you're human, you don't have a substantially different notion of trust than I do. It's part of human psychology. We had to evolve it as social beings. I've seen very ad hoc CS papers on "trust", though, which IMHO were based on nothing but fantasy. Perhaps you had one of those re-definitions in mind. I tried to contribute to this pointless literature myself for a while until I realized that it's completely fictitious. All you can say from a mathematical perspective is that trust builds up very slowly based on a numerous factors and, if betrayed, goes down very fast and stays there. However, the notion doesn't have enough substance for a fruitful non-psychological modeling; there is just not enough ideal rationality behind it.

Re: Let's Encrypt bans certificate usage in any US sanctioned territory [pdf]

#383

Post by Citizen8396 »

FireBeyond wrote: post #295
jaas wrote: post #239

Earlier quoted context omitted.

Let's Encrypt continues to be available to almost every vulnerable population in the world, including those that need it most. I say almost as I'm hesitant to speak in absolutes regarding a topic as complex as this. Most of our sanctions-related blocks apply only to the governments of certain sanctioned countries, not their general population. This subscriber agreement update was intended to better reflect our legal…

> Most of our sanctions-related blocks apply only to the governments of certain sanctioned countries, not their general population. The agreement very plainly says otherwise: > You are not a person or entity that is: (a) located in, organized under the laws of, or ordinarily resident in any country or territory that is the target of comprehensive U.S. sanctions The general population of those countries are absolutely…

OFAC sanctions are far more nuanced than what you make them out to be. Very often "general licenses" are carved out for providing IT services or technology to individuals for personal use. The purpose of this is for censorship circumvention, which often supports American interests abroad.

This is not something that you apply for; a general license already applies to everyone. The legalese or restrictions companies use exist because they cannot (or will not) validate everyone is who they say they are. This obviously doesn't apply to companies who deal with controlled exports, where they are responsible for whoever ultimately receives the controlled export.

I am not a lawyer and this is not legal advice.

https://ofac.treasury.gov/selected-general-licenses-issued-o...

Re: Let's Encrypt bans certificate usage in any US sanctioned territory [pdf]

#384

Post by Citizen8396 »

undecisive wrote: post #358
FireBeyond wrote: post #295

Earlier quoted context omitted.

> Most of our sanctions-related blocks apply only to the governments of certain sanctioned countries, not their general population. The agreement very plainly says otherwise: > You are not a person or entity that is: (a) located in, organized under the laws of, or ordinarily resident in any country or territory that is the target of comprehensive U.S. sanctions The general population of those countries are absolutely…

They have "clarified" elsewhere on here that the normal citizenry get a legal exemption [waves hands mystically] somehow, and that they're only blocking people when they legally have to. Obviously (to the rest of us) if the agreement says otherwise, then they're saying that it's LE that is forbidding the citizens of these countries, and it's not (entirely) the government's fault, which completely contradicts what the…

"Somehow" is addressed in my comment: https://news.ycombinator.com/item?id=48479348

Re: Let's Encrypt bans certificate usage in any US sanctioned territory [pdf]

#385

Post by toast0 »

Parodper wrote: post #340
toast0 wrote: post #197

Earlier quoted context omitted.

I'm not really in favor of DANE, because DNSSEC is such a mess ... but. Certificate transparency is nice. Browsers could require it for DANE certificates, just like they require it for current Web PKI certificates. The people controlling the TLD of interesting can exert control over the domain of interest in order to issue a DANE certificate. But they can also exert control over the domain of interest in order to req…

And if they don't, DNS is already a database. You could just query domains to check their certificates. People running recursive DNS servers could double-check certificates.

If the DNS takeover is limited in scope, the legitimate owner wouldn't be able to query it.

CT addresses scoped attacks by making all webpki trusted certificates public knowledge. You would want something similar with DANE.

Re: Let's Encrypt bans certificate usage in any US sanctioned territory [pdf]

#386

Post by morpheuskafka »

greyface- wrote: post #210
dsl wrote: post #175

Earlier quoted context omitted.

> pretty sure this is stems from the insane US legal requirement to not export SSL technology to enemy countries This is most likely OFAC. Lets Encrypt could apply for a license to do business with sanctioned entities, and given their use case it would most likely be approved. https://ofac.treasury.gov/ofac-license-application-page

OFAC regulates commerce, not speech. Let's Encrypt is not doing "business", they're operating a free informational service. Lots of organizations interpret any information exchange as subject to OFAC regulation, and you and Let's Encrypt have good company in this interpretation, but I think it's unnecessarily ceding ground.

Providing information (website, CT log, CRL) is fine, but creating a certificate on request is clearly a service. How is that different than providing a computation or LLM output in response to a prompt? Moreover, it is clearly not just the physical act of signing a CSR, but the verification of ownership that comes with it. That's just as much as service fully automated as if a human were doing it.

Now, does this serve a policy purpose? Perhaps not--US computers trust plenty of non-US CAs that could continue to serve these customers. But that's not how comprehensive sanctions are set up, they are effectively a complete embargo.

A better question is whether telecom carveouts (general licenses) in the sanctions may allow this. That is a country by country question as each one is worded differently.

Re: Let's Encrypt bans certificate usage in any US sanctioned territory [pdf]

#387

Post by fluoridation »

yreg wrote: post #320
fluoridation wrote: post #227

Earlier quoted context omitted.

A certificate is not cryptography, though, it's a number. The entity requesting the certificate already has the cryptographic software installed on their servers, as do the clients trying to connect to them. There's nothing technologically special about the number, it's all in the realm of the social contract, in that it has been blessed by a chain of trust.

Everything is a number.

You can represent arbitrary data as a string of numbers, but a certificate is quite literally a number. It's a secret solution to a mathematical equation.

Re: Let's Encrypt bans certificate usage in any US sanctioned territory [pdf]

#388

Post by greyface- »

morpheuskafka wrote: post #386
greyface- wrote: post #210

Earlier quoted context omitted.

OFAC regulates commerce, not speech. Let's Encrypt is not doing "business", they're operating a free informational service. Lots of organizations interpret any information exchange as subject to OFAC regulation, and you and Let's Encrypt have good company in this interpretation, but I think it's unnecessarily ceding ground.

Providing information (website, CT log, CRL) is fine, but creating a certificate on request is clearly a service. How is that different than providing a computation or LLM output in response to a prompt? Moreover, it is clearly not just the physical act of signing a CSR, but the verification of ownership that comes with it. That's just as much as service fully automated as if a human were doing it. Now, does this ser…

OFAC has authority to regulate commercial services under the Commerce Clause. Not all services are commercial in nature. There is no economic exchange inherent in running a certificate authority. If LE charged money for certificates, that would be a different matter. LE's differentiating factor from the previous era of CAs is that they are non-commercial.

Re: Let's Encrypt bans certificate usage in any US sanctioned territory [pdf]

#389

Post by FireBeyond »

Citizen8396 wrote: post #383
FireBeyond wrote: post #295

Earlier quoted context omitted.

> Most of our sanctions-related blocks apply only to the governments of certain sanctioned countries, not their general population. The agreement very plainly says otherwise: > You are not a person or entity that is: (a) located in, organized under the laws of, or ordinarily resident in any country or territory that is the target of comprehensive U.S. sanctions The general population of those countries are absolutely…

OFAC sanctions are far more nuanced than what you make them out to be. Very often "general licenses" are carved out for providing IT services or technology to individuals for personal use. The purpose of this is for censorship circumvention, which often supports American interests abroad. This is not something that you apply for; a general license already applies to everyone. The legalese or restrictions companies us…

I get this, but you say "very often", but it's not, and generally, looking at OFAC lists, there's only a few countries with personal carveouts (less than 5 of the countries on the list), usually for remittances, and in a few of those countries only to US persons residing there.

Generally the software carveouts are very limited - it's not just "providing IT services or technology to individuals for personal use", i.e. Sudan:

> software updates for medical devices to Sudan

Indeed, of the software carveouts listed on that page, only two are not related to the operation or update of medical devices:

- provision of Internet services to the people of the Ukraine (read: "Starlink")

- provision of messaging services to members of the Government of Venezuela.

Re: Let's Encrypt bans certificate usage in any US sanctioned territory [pdf]

#390

Post by necovek »

FireBeyond wrote: post #295
jaas wrote: post #239

Earlier quoted context omitted.

Let's Encrypt continues to be available to almost every vulnerable population in the world, including those that need it most. I say almost as I'm hesitant to speak in absolutes regarding a topic as complex as this. Most of our sanctions-related blocks apply only to the governments of certain sanctioned countries, not their general population. This subscriber agreement update was intended to better reflect our legal…

> Most of our sanctions-related blocks apply only to the governments of certain sanctioned countries, not their general population. The agreement very plainly says otherwise: > You are not a person or entity that is: (a) located in, organized under the laws of, or ordinarily resident in any country or territory that is the target of comprehensive U.S. sanctions The general population of those countries are absolutely…

Sounds like "comprehensive" does the heavy-lifting here (in "country or territory that is the target of comprehensive U.S. sanctions"): what countries are under comprehensive sanctions, and which are under non-comprehensive sanctions?
Post reply on HN