Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Launching in 2015: A Certificate Authority to Encrypt the Entire Web

eff.org

Post reply on HN
Print view View original

91–100 of 476 posts

Re: Launching in 2015: A Certificate Authority to Encrypt the Entire Web

#91

Post by schoen »

general_failure wrote: post #35
overshard wrote: post #11

The "How It Works" page, https://letsencrypt.org/howitworks/ , has me a bit worried. Anytime I see a __magic__ solution that has you running a single command to solve all your problems I immediately become suspicious at how much thought went into the actual issue. If I'm running a single web app on a single Ubuntu server using Apache then I'm set! If I'm running multiple web apps across multiple servers using a load…

I don't get why they are releasing a command line, instead of just giving us a cert that we can install by ourselves.

It's primarily because of the interactive challenge to prove that you control the domains you're requesting the cert for.

If you want, the client can just give you the cert at the end instead of installing it. In the common case for a user who's not currently comfortable with the process, the client is automating several things -- generating a private key and CSR, proving control of the domain, and installing the key and cert in the server.

Re: Launching in 2015: A Certificate Authority to Encrypt the Entire Web

#92

Post by lazyjones »

iancarroll wrote: post #79
lazyjones wrote: post #75

Earlier quoted context omitted.

> no. It means "even though this connection is encrypted, there is no way to tell you whether you are currently talking to that site or to NSA which is forwarding all of your traffic to the site you're on". That would be correct if you could assume that the NSA couldn't fake certificates for websites. But it can, so it's wrong and misleading. It's certificate pinning, notary systems etc. that actually give some credi…

The NSA has no CA. The only attack they really have is brute force or server compromise - both of which undermine pinning.

They can get US corporations (including many CAs) to cooperate. For example, to obtain a fake (but perfectly working google.com certificate, they can ask Google (more or less) nicely to provide one, or they can go ask any CA instead. It's not likely that compromise is required with so many potential sources, some of which may be paid or coerced to cooperate.

PS. nice (presumably political) downvote further up ...

Re: Launching in 2015: A Certificate Authority to Encrypt the Entire Web

#93

Post by spindritf »

ACME sounds great. Copying codes from emails is suboptimal at best. Free certificate from command line and free revocation from the same client sound even better.

I just don't know about the automatic configuration tool. Like webpanels for managing a server, it has never worked for me.

Re: Launching in 2015: A Certificate Authority to Encrypt the Entire Web

#94

Post by BogdanCalin »

eyeareque wrote: post #52

This is great news, but I am wondering how they will handle revoking certificates. For example: Do we really want malware sites popping up with valid Ssl certificates?

You can revoke the certificates from the command line. It's shown at the end of the video.

Re: Launching in 2015: A Certificate Authority to Encrypt the Entire Web

#95

Post by im3w1l »

lazyjones wrote: post #75
pilif wrote: post #60

Earlier quoted context omitted.

> A self signed certificate warning means "Warning! The admin on the site you're connecting to wants this conversation to be private but it hasn't been proven that he has 200 bucks for us to say he's cool" no. It means "even though this connection is encrypted, there is no way to tell you whether you are currently talking to that site or to NSA which is forwarding all of your traffic to the site you're on". Treating…

> no. It means "even though this connection is encrypted, there is no way to tell you whether you are currently talking to that site or to NSA which is forwarding all of your traffic to the site you're on". That would be correct if you could assume that the NSA couldn't fake certificates for websites. But it can, so it's wrong and misleading. It's certificate pinning, notary systems etc. that actually give some credi…

I agree. A more common MITM, and that it actually would prevent, comes from a rogue wifi operator.

Re: Launching in 2015: A Certificate Authority to Encrypt the Entire Web

#96

Post by iancarroll »

lazyjones wrote: post #92
iancarroll wrote: post #79

Earlier quoted context omitted.

The NSA has no CA. The only attack they really have is brute force or server compromise - both of which undermine pinning.

They can get US corporations (including many CAs) to cooperate. For example, to obtain a fake (but perfectly working google.com certificate, they can ask Google (more or less) nicely to provide one, or they can go ask any CA instead. It's not likely that compromise is required with so many potential sources, some of which may be paid or coerced to cooperate. PS. nice (presumably political) downvote further up ...

One would hope certificate transparency would help fix this problem.

(for the record, I didn't downvote you)

Re: Launching in 2015: A Certificate Authority to Encrypt the Entire Web

#97

Post by joshmoz »

mangeletti wrote: post #45

So, one CA to rule then all? There's a scenario (simplified for illustration, but entirely possible) that's normally not a huge risk because there are many CAs, and they are private, for-profit companies that have an economic incentive to protect you and your certificate's ability to assure end users that a conversation's privacy won't be compromised. 1) browser requests site via SSL 2) MITM says, "let's chat - here'…

This is not an attempt to reduce the CA system to a single CA. The intent here is to provide a simple and free way for anyone to get basic DV certs. If we can also contribute to CA best practices, and help improve the CA system in general, we'd like to do that too.

Let's Encrypt is only planning to issue DV certificates, since that is the only type that can be issued in a fully automated way. Many organizations will want something other than DV, and they'll have to get such certs from other CAs.

Also, our software and protocols are open so that other CAs can make use of them.

Re: Launching in 2015: A Certificate Authority to Encrypt the Entire Web

#98

Post by schoen »

mangeletti wrote: post #88
pde3 wrote: post #78

Earlier quoted context omitted.

Let's Encrypt is going to publish records of everything it signs, either with Certificate Transparency or some other mechanism. Browsers will be able to check any cert signed by the Let's Encrypt CA against the published list. If there's a discrepancy, that will be immediately detectable.

Out of curiosity, what if MITM says, "include me in this list for IP "? If the check is not done in a way that solves the byzantine generals problem, I don't see how this feature provides any more protection, other than one more hoop to jump through.

Certificate Transparency tries to solve the Byzantine Generals problem (up to high levels of collusion). Take a peek at their design -- it's pretty interesting!

It does rely on the legitimate site owner actively checking the records to notice the misissuance. Maybe that process could be automated somehow.

Re: Launching in 2015: A Certificate Authority to Encrypt the Entire Web

#99

Post by spindritf »

vbezhenar wrote: post #64

We have DNS system in place which should be enough to establish trust between browser and SSL public key. E.g. site could store self-signed certificate fingerprint in the DNS record and browser should be fine with that. If DNS system is spoofed, user will be in bad place anyway so DNS system must be secured in any case.

No. A proper certificate protects against malicious DNS resolver.

What you're talking about is being introduced alongside DNSSEC, and it's called DANE.

https://en.wikipedia.org/wiki/DNS-based_Authentication_of_Na...

Re: Launching in 2015: A Certificate Authority to Encrypt the Entire Web

#100

Post by abritishguy »

tmmm wrote: post #54
jolan wrote: post #53

Earlier quoted context omitted.

The "How It Works" page ( https://letsencrypt.org/howitworks/ ) says: - Obtain a browser-trusted certificate and set it up on your web serve IdenTrust is listed as a sponsor and is the CA for the letsencrypt.org certificate so I'm guessing they're doing some sort of partnership.

I mean ordinary people who will visit the page.

"browser-trusted certificate" < it is already trusted by them
Post reply on HN