Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Launching in 2015: A Certificate Authority to Encrypt the Entire Web

eff.org

Post reply on HN
Print view View original

11–20 of 476 posts

Re: Launching in 2015: A Certificate Authority to Encrypt the Entire Web

#11

Post by overshard »

The "How It Works" page, https://letsencrypt.org/howitworks/, has me a bit worried. Anytime I see a __magic__ solution that has you running a single command to solve all your problems I immediately become suspicious at how much thought went into the actual issue.

If I'm running a single web app on a single Ubuntu server using Apache then I'm set! If I'm running multiple web apps across multiple servers using a load balancer, nginx on FreeBSD then...

All the same I'm really looking forward to this coming out, it can be nothing but good that all of these companies are backing this new solution and I'm sure it'll expand and handle these issues as long as a good team is behind it.

Re: Launching in 2015: A Certificate Authority to Encrypt the Entire Web

#13

Post by p4bl0 »

sschueller wrote: post #4

A little vague on details. Apache only or also Nginx? Who is the CA? No way I am running something like this on a production machine. I like the idea but I would rather have the client just output the certificate and key in a dir so I can put the files where I need them and I can configure the changes to my webserver. Also this does not solve the issue of a CA issuing certificates for your domain and doing MITM.

For those who are wondering why sschueller is saying such things (when I first read his comment my reaction was "how the f* could this be limited to Apache?", which worried me since I mostly use lighttpd), see the How It Works page [1] of Let's Encrypt.

> I would rather have the client just output the certificate and key in a dir

Could not agree more.

[1] https://letsencrypt.org/howitworks/

Re: Launching in 2015: A Certificate Authority to Encrypt the Entire Web

#14

Post by ithkuil »

lowglow wrote: post #3

Free CA? This is cool. Why this wasn't done a long time ago is beyond me. (Also please support wildcard certs) An interesting thing happened at a meet-up at Square last year. Someone from google's security team came out and demonstrated what google does to notify a user that a page has been compromised or is a known malicious attack site. During the presentation she was chatting about how people don't really pay atte…

> Free CA? This is cool. Why this wasn't done a long time ago is beyond me. (Also please support wildcard certs)

There have been previous attempts, e.g. http://www.cacert.org/

AFAIK they failed in the politics front (getting accepted in mainstream browsers). Sounds like EFF might have better leverage.

Re: Launching in 2015: A Certificate Authority to Encrypt the Entire Web

#15

Post by hughes »

Aardwolf wrote: post #6

My website only contains publically available stuff for people to read. Is there any reason why I would want to use https for this use case? Or what does "entire web" mean?

Only with https could you be sure that your visitors are viewing the exact information you published, and that the content has not been hijacked.

Over http it could conceivably have malicious or tracking content introduced without your knowledge.

Re: Launching in 2015: A Certificate Authority to Encrypt the Entire Web

#16

Post by pencilcode »

Aardwolf wrote: post #6

My website only contains publically available stuff for people to read. Is there any reason why I would want to use https for this use case? Or what does "entire web" mean?

People could think they are reading an article from your site but actually they're not or the text was tampered with. With https you ensure people are actually reading what you published.

Re: Launching in 2015: A Certificate Authority to Encrypt the Entire Web

#18

Post by rdrey »

sschueller wrote: post #4

A little vague on details. Apache only or also Nginx? Who is the CA? No way I am running something like this on a production machine. I like the idea but I would rather have the client just output the certificate and key in a dir so I can put the files where I need them and I can configure the changes to my webserver. Also this does not solve the issue of a CA issuing certificates for your domain and doing MITM.

I'm sure they'd support "manual setup". Not many sites would opt into running their software agent (yet). I'm expecting the client to come with a lot more benefits than "simple setup", though.

Re: Launching in 2015: A Certificate Authority to Encrypt the Entire Web

#19

Post by mike_hearn »

lowglow wrote: post #3

Free CA? This is cool. Why this wasn't done a long time ago is beyond me. (Also please support wildcard certs) An interesting thing happened at a meet-up at Square last year. Someone from google's security team came out and demonstrated what google does to notify a user that a page has been compromised or is a known malicious attack site. During the presentation she was chatting about how people don't really pay atte…

It wasn't done a long time ago because running a CA costs money (which is why they charge for certificates), so whoever signs up to run one is signing up for a money sink with no prospect of direct ROI, potentially for a loooooong time. This new CA is to be run by a non-profit that uses corporate sponsorship rather than being supported by the market; whether that's actually a better model in the long run is I suppose an open question. But lots of other bits of internet infrastructure are funded this way, so perhaps it's no big deal.

There aren't a whole lot of privacy concerns with CA's as long as you use OCSP stapling, so users browsers aren't hitting up the CA each time they visit a website (Chrome never does this but other browsers can do).

Re: CA compromise. One reason running a CA costs money is that the root store policies imposed by the CA/Browser Forum require (I think!) the usage of a hardware security module which holds the signing keys. This means a compromised CA could issue a bunch of certs for as long as the compromise is active, but in theory it should be hard or impossible to steal the key. Once the hackers are booted out of the CA's network, it goes back to being secure. Of course quite some damage can be done during this time, and that's what things like Certificate Transparency are meant to mediate - they let everyone see what CAs are doing.

Re: Launching in 2015: A Certificate Authority to Encrypt the Entire Web

#20

Post by akadruid1 »

sschueller wrote: post #4

A little vague on details. Apache only or also Nginx? Who is the CA? No way I am running something like this on a production machine. I like the idea but I would rather have the client just output the certificate and key in a dir so I can put the files where I need them and I can configure the changes to my webserver. Also this does not solve the issue of a CA issuing certificates for your domain and doing MITM.

ACME is a protocol for securely and automatically issuing certificates. Presumably Apache, Nginx, IIS and any other web server could take advantage of it.

They are creating a new CA for this purpose.

I can't imagine this will replace the manual learn-pay-experiment-error-success process we have at the moment, so experts will still be able to control the process manually.

It doesn't address CA MITM attacks but it does significantly reduce non-CA MITM attacks by remove the two primary objections to deploying SSL: cost and complexity. Bravo EFF - this could be the most significant step in SSL adoption ever.

Post reply on HN