This is awesome! It looks like what CACert.org set out to be, except this time instead of developing the CA first and then seeking certification (which has been a problem due to the insanely expensive audit process), but the EFF got the vendors on board first and then started doing the nuts and bolts.
This is huge if it takes off. The CA PKI will no longer be a scam anymore!!
I'd trust the EFF/Mozilla over a random for profit "security corporation" like VeriSign any day of the week and twice on Sunday to be good stewards of the infrastructure.
My website only contains publically available stuff for people to read. Is there any reason why I would want to use https for this use case? Or what does "entire web" mean?
Sure! If I trust your site but not my ISP, then https allows me to trust the connection between us. That means that nobody can tamper with the content and inject some malicious JS. Also, the ISP could only tell that I am talking to your server, and not anything beyond that.
A little vague on details. Apache only or also Nginx? Who is the CA? No way I am running something like this on a production machine. I like the idea but I would rather have the client just output the certificate and key in a dir so I can put the files where I need them and I can configure the changes to my webserver. Also this does not solve the issue of a CA issuing certificates for your domain and doing MITM.
This is just a pre-announcement to let folks (OSes, hosting providers, other platforms) plan and do integration work. Per our own warnings, we definitely don't want this running on production machines until it launches in 2015. Our Apache code is a developer preview, we'll be working on Nginx next. ISRG will be operating a new root CA for this project. Although if you think that your choice of CA makes you more or le…
> ISRG will be operating a new root CA for this project.
Are you going to be cross-signed by IdenTrust or something? If you're really going to try and create a new root CA from scratch, surely you will be impaled on the spike of low coverage for many years?
My website only contains publically available stuff for people to read. Is there any reason why I would want to use https for this use case? Or what does "entire web" mean?
If you're not using HTTPS it is trivial for anyone in the middle of the "client to server and back" connection to change any of the content.
If you use HTTPS you prevent alterations to that traffic and people receive exactly what you expect they should receive.
Note that the Verizon issue isn't anything entirely content altering but someone who lives in a country with strict monitoring of traffic could easily change the wording of your website to match their propaganda if you aren't using HTTPS.
So yes, your content is publicly available free stuff and no one is probably sending you user login credentials or credit cards but it still matters.
Free CA? This is cool. Why this wasn't done a long time ago is beyond me. (Also please support wildcard certs) An interesting thing happened at a meet-up at Square last year. Someone from google's security team came out and demonstrated what google does to notify a user that a page has been compromised or is a known malicious attack site. During the presentation she was chatting about how people don't really pay atte…
I'll run a free CA right now. Who wants a cert for microsoft.com?
NB: This is a bit unfair, because the existing for-money CAs haven't always stopped someone from registering microsoft.com.
A little vague on details. Apache only or also Nginx? Who is the CA? No way I am running something like this on a production machine. I like the idea but I would rather have the client just output the certificate and key in a dir so I can put the files where I need them and I can configure the changes to my webserver. Also this does not solve the issue of a CA issuing certificates for your domain and doing MITM.
This is just a pre-announcement to let folks (OSes, hosting providers, other platforms) plan and do integration work. Per our own warnings, we definitely don't want this running on production machines until it launches in 2015. Our Apache code is a developer preview, we'll be working on Nginx next. ISRG will be operating a new root CA for this project. Although if you think that your choice of CA makes you more or le…
"ISRG will be operating a new root CA for this project."
Does that mean every client/browser will need to be updated to include the new CA? Or will it somehow be signed by other (competing) CAs?
I like the idea of this project, and I think it's a great thing for the Internet - I just worry that it will take a long time for it to be usable in practice.
Free CA? This is cool. Why this wasn't done a long time ago is beyond me. (Also please support wildcard certs) An interesting thing happened at a meet-up at Square last year. Someone from google's security team came out and demonstrated what google does to notify a user that a page has been compromised or is a known malicious attack site. During the presentation she was chatting about how people don't really pay atte…
If each domain name can get a non-wildcard cert for free, quickly, why do you need wildcard certs? For multi-subdomain hosting on one server? Just wondering.
Free CA? This is cool. Why this wasn't done a long time ago is beyond me. (Also please support wildcard certs) An interesting thing happened at a meet-up at Square last year. Someone from google's security team came out and demonstrated what google does to notify a user that a page has been compromised or is a known malicious attack site. During the presentation she was chatting about how people don't really pay atte…
I think the issue of whether or not there should be a wide new industry borne on the back of the CA architecture, its all a bit of a red-herring, anyway. This is only security at the web browser: do we trust our OS vendors to be CA's, too? If so, then I think we may see a cascade/avalanche of new CA's being constructed around the notion of the distribution. I know for sure, even if I have all the S's in the HTTP in order, my machine itself is still a real weak point. When, out of the box, the OS is capable of building its own certified binaries and adding/denying capabilities of its build products, inherently, then we'll have an interesting security environment. This browser-centric focus of encryption is but the beachhead for more broader issues to come, methinks; do you really trust your OS vendor? Really?