Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Launching in 2015: A Certificate Authority to Encrypt the Entire Web

eff.org

Post reply on HN
Print view View original

121–130 of 476 posts

Re: Launching in 2015: A Certificate Authority to Encrypt the Entire Web

#121

Post by grey-area »

general_failure wrote: post #35
overshard wrote: post #11

The "How It Works" page, https://letsencrypt.org/howitworks/ , has me a bit worried. Anytime I see a __magic__ solution that has you running a single command to solve all your problems I immediately become suspicious at how much thought went into the actual issue. If I'm running a single web app on a single Ubuntu server using Apache then I'm set! If I'm running multiple web apps across multiple servers using a load…

I don't get why they are releasing a command line, instead of just giving us a cert that we can install by ourselves.

Here's the current process:

Generate key, Generate CSR, Send CSR, Receive Certs from CA, Verify ownership, Install certs

Presumably their command line client creates the key, the CSR, sends the CSR, then gets back the certs (at least I'd hope so). I'd be happy to use a vetted command line utility which did that, or even just parts of that process, if I were sure the private key were not transmitted. It's just automating stuff which with current CAs needs to be done manually.

Re: Launching in 2015: A Certificate Authority to Encrypt the Entire Web

#122

Post by jstanley »

eyeareque wrote: post #52

This is great news, but I am wondering how they will handle revoking certificates. For example: Do we really want malware sites popping up with valid Ssl certificates?

Why not? If you own the domain you can get a DV cert, whether you use the domain for malicious purposes or not.

The certificate isn't saying "this website won't infect your computer", it's saying "you're talking to the real owner of this domain".

Re: Launching in 2015: A Certificate Authority to Encrypt the Entire Web

#123

Post by balabaster »

How does a CA that's formed by a conglomerate of U.S. companies (under the jurisdiction of the NSA) make us any safer than we are currently? It doesn't. The chain of trust chains up all the way to a U.S. company, which can be coerced into giving up the certificate and compromising the security of the entire chain. I'm on the side of the EFF trying to encrypt the web, but this is not the solution.

Re: Launching in 2015: A Certificate Authority to Encrypt the Entire Web

#124

Post by na85 »

danielweber wrote: post #119
pilif wrote: post #60

Earlier quoted context omitted.

> A self signed certificate warning means "Warning! The admin on the site you're connecting to wants this conversation to be private but it hasn't been proven that he has 200 bucks for us to say he's cool" no. It means "even though this connection is encrypted, there is no way to tell you whether you are currently talking to that site or to NSA which is forwarding all of your traffic to the site you're on". Treating…

Browsers shouldn't silently accept self-signed, but there is a class of servers where self-signed is the best we've got: connecting to embedded devices. If I want to talk to the new printer or fridge I got over the web, they have no way of establishing trust besides Tacking my first request to them.

Oh god, they have internet fridges now? What on earth for?

Re: Launching in 2015: A Certificate Authority to Encrypt the Entire Web

#126

Post by grey-area »

Aardwolf wrote: post #6

My website only contains publically available stuff for people to read. Is there any reason why I would want to use https for this use case? Or what does "entire web" mean?

Is there any reason why I would want to use https for this use case?

Yes it can help you stop:

ISPs inserting adverts into your content (this has happened)

Governments censoring your content or rewriting it

Governments putting people in jail for reading your publicly available (in your country) content, which is illegal in theirs

People impersonating your website

But if you don't want to use it, that's cool too. I suspect all websites will be encrypted at some point soon though, the disadvantages are getting less and less important.

Re: Launching in 2015: A Certificate Authority to Encrypt the Entire Web

#127

Post by icebraining »

danielweber wrote: post #119
pilif wrote: post #60

Earlier quoted context omitted.

> A self signed certificate warning means "Warning! The admin on the site you're connecting to wants this conversation to be private but it hasn't been proven that he has 200 bucks for us to say he's cool" no. It means "even though this connection is encrypted, there is no way to tell you whether you are currently talking to that site or to NSA which is forwarding all of your traffic to the site you're on". Treating…

Browsers shouldn't silently accept self-signed, but there is a class of servers where self-signed is the best we've got: connecting to embedded devices. If I want to talk to the new printer or fridge I got over the web, they have no way of establishing trust besides Tacking my first request to them.

Technically, there's no reason why a fridge couldn't have a signed cert tied to some dynamic DNS (e.g. ..).

Re: Launching in 2015: A Certificate Authority to Encrypt the Entire Web

#128

Post by icebraining »

na85 wrote: post #124
danielweber wrote: post #119

Earlier quoted context omitted.

Browsers shouldn't silently accept self-signed, but there is a class of servers where self-signed is the best we've got: connecting to embedded devices. If I want to talk to the new printer or fridge I got over the web, they have no way of establishing trust besides Tacking my first request to them.

Oh god, they have internet fridges now? What on earth for?

http://en.wikipedia.org/wiki/Internet_refrigerator
Post reply on HN