Launching in 2015: A Certificate Authority to Encrypt the Entire Web • Hacker News Board

Re: Launching in 2015: A Certificate Authority to Encrypt the Entire Web

#161

Post by X-Istence » Tue, Nov 18, 2014, 5:36 PM UTC

medmunds wrote: post #137

cmwright wrote: post #34

Earlier quoted context omitted.

For my previous use cases, it's ideal for dynamically created subdomains of a web application. If I know ahead of time, it's easy to grab a cert for any subdomain. However if a user is creating subdomains for a custom site or something similar, it's much nicer/easier to have the wildcard cert.

The lets-encrypt demo makes it look like you could easily script cert acquisition for new subdomains. And the CA domain validation appears to be totally automated (and fast).

The downside is that now I have to manage and deal with multiple certs for all of my sub-domains, rather than dealing with a single cert/key pair.

Re: Launching in 2015: A Certificate Authority to Encrypt the Entire Web

#162

Post by themartorana » Tue, Nov 18, 2014, 5:36 PM UTC

zobzu wrote: post #68

Whos auditing the ca?

Who's auditing the auditors? Remember Moody's? It's not entirely analogous, but it's not far from it.

At some point down the chain, you have to rely on trust to some degree. Either disappear in to the wilderness and completely disconnect from the grid or - at some point - you have to trust someone.

Re: Launching in 2015: A Certificate Authority to Encrypt the Entire Web

#163

Post by jerf » Tue, Nov 18, 2014, 5:38 PM UTC

icebraining wrote: post #159

jerf wrote: post #149

Earlier quoted context omitted.

But note that only works if the manufacturer can choose the name without an issue from the customer. For things like network appliances in larger companies that aren't going to want [generic number]manufacturer.com but want [my name].corp.[my company].com, you're stuck.

Allow the cert to be configurable, then the company can use its internal CA to give certs to all its appliances.

Yes, that's the status quo, and has been for a while. The point is that's currently the best you can do. For boxes without external exposure, this work won't change anything, but a standardized protocol for dealing with boxes with external exposure would still help some use cases.

Re: Launching in 2015: A Certificate Authority to Encrypt the Entire Web

#164

Post by iancarroll » Tue, Nov 18, 2014, 5:39 PM UTC

teamhappy wrote: post #109

I couldn't be happier about the news, the EFF and Mozilla always had a special place in my heart. However, the fact that we have to wait for our free certificates until the accompanying command line tool is ready for prime time seems unnecessary. Another thing I'm interested in is whether they provide advanced features like wildcard certificates. This is usually the kind of thing CA's charge somewhat significant amou…

I doubt the actual CA has been setup either. They're setting up their own root while cross signing from IdenTrust, that's not a one day activity. Auditors have to be present, software has to be designed and tested, etc.

Re: Launching in 2015: A Certificate Authority to Encrypt the Entire Web

#165

Post by pde3 » Tue, Nov 18, 2014, 5:40 PM UTC

tatterdemalion wrote: post #87

pde3 wrote: post #67

Earlier quoted context omitted.

You're absolutely right. From first principles, HTTP should have a louder warning than self-signed HTTPS. Our hope is that Let's Encrypt will reduce the barriers to CA-signed HTTPS sufficiently, that it will become realistic for browsers to show warning indicators on HTTP. If they did that today, millions of sites would complain, "why are you forcing us to pay money to CAs, and deal with the incredible headache of ce…

Thanks for doing this. It's really great and its something that clearly needs to happen. The next step will be to replace the CA system with something actually secure, but that comes after we move the web to a place where most websites are at least trying.

We'll be in a position to deploy defenses like pinning (http://www.ietf.org/id/draft-ietf-websec-key-pinning-21.txt) for site operators who want more protection against the structural problems of the CA system. That will need to be implemented with care, but it should be possible.

Re: Launching in 2015: A Certificate Authority to Encrypt the Entire Web

#166

Post by syshax » Tue, Nov 18, 2014, 5:41 PM UTC

digitalsushi wrote: post #32

This certificate industry has been such a racket. It's not even tacit that there are two completely separate issues that certificates and encryption solve. They get conflated and non technical users rightly get confused about which thing is trying to solve a problem they aren't sure why they have. The certificate authorities are quite in love that the self-signed certificate errors are turning redder, bolder, and big…

I have some certificates through RapidSSL, and when they send me reminders to renew, the e-mails come with this warning:

"Your certificate is due to expire.

If your certificate expires, your site will no longer be encrypted."

Just blatantly false.

Re: Launching in 2015: A Certificate Authority to Encrypt the Entire Web

#167

Post by akerl_ » Tue, Nov 18, 2014, 5:41 PM UTC

mangeletti wrote: post #101

fragsworth wrote: post #85

Earlier quoted context omitted.

That doesn't even remotely work, who has the private keys to authorize the certificates?

What authorization is required in this scenario? I'm talking about a novel idea here, one that doesn't fit into the existing CA model. There would be no CA in this scenario; verification would be decentralized, based on shared information, not on knowledge of a secret.

I'm not sure web-of-trust can be considered a novel idea in 2014.

We can all look at the variety of web-of-trust methods to see how well that's taken off amongst internet users.

Re: Launching in 2015: A Certificate Authority to Encrypt the Entire Web

#168

Post by steven2012 » Tue, Nov 18, 2014, 5:42 PM UTC

This is an awesome idea. But I thought the whole idea of a certificate authority is so that we can trust that the CA has vetted the person/site that they have given the certificate to. If all they do is issue certs for free, all we get is encryption, but no identity verification.

Re: Launching in 2015: A Certificate Authority to Encrypt the Entire Web

#169

Post by ademarre » Tue, Nov 18, 2014, 5:43 PM UTC

This is great news! I'd also like to see a push for technologies like DANE (and necessarily DNSSEC) which address the flawed CA trust model.

While we're at it, let's get a non-profit domain registrar going.

Re: Launching in 2015: A Certificate Authority to Encrypt the Entire Web

#170

Post by hdevalence » Tue, Nov 18, 2014, 5:45 PM UTC

pbhjpbhj wrote: post #152

grey-area wrote: post #126

Earlier quoted context omitted.

Is there any reason why I would want to use https for this use case? Yes it can help you stop: ISPs inserting adverts into your content (this has happened) Governments censoring your content or rewriting it Governments putting people in jail for reading your publicly available (in your country) content, which is illegal in theirs People impersonating your website But if you don't want to use it, that's cool too. I su…

> Governments putting people in jail for reading your publicly available (in your country) content, which is illegal in theirs // How does that work, surely the gov can still see people accessing the information by monitoring network traffic and the info itself is still public. HTTPS doesn't encrypt the actual request traffic does it, and in any case the gov would still see which server the traffic is going to unless…

There's a difference between

"User X browses Wikipedia"

and

"User X browses Wikipedia articles about topics A, B, C"

where topics A, B, C could be anything user X doesn't want people recording them reading about: for instance, various political articles, articles about mental illness, articles about LGBT issues, etc. Fill in the blanks.