Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Launching in 2015: A Certificate Authority to Encrypt the Entire Web

eff.org

Post reply on HN
Print view View original

171–180 of 476 posts

Re: Launching in 2015: A Certificate Authority to Encrypt the Entire Web

#171

Post by wnevets »

anonbanker wrote: post #151
iancarroll wrote: post #110

Earlier quoted context omitted.

I don't know why AOL keeps being brought up, but it's highly unlikely they would do this. For one, it's probably used internally for smart cards/SMIME. Secondly, it'd be very hard to get AOL to spend money on doing something for free. Moving a CA to a different company is no small feat, operationally...

AOL bought Netscape, and incubated the Mozilla project while Netscape was still alive. they've spent a lot of money on doing things for free.

how long ago was that?

Re: Launching in 2015: A Certificate Authority to Encrypt the Entire Web

#172

Post by teamhappy »

iancarroll wrote: post #164
teamhappy wrote: post #109

I couldn't be happier about the news, the EFF and Mozilla always had a special place in my heart. However, the fact that we have to wait for our free certificates until the accompanying command line tool is ready for prime time seems unnecessary. Another thing I'm interested in is whether they provide advanced features like wildcard certificates. This is usually the kind of thing CA's charge somewhat significant amou…

I doubt the actual CA has been setup either. They're setting up their own root while cross signing from IdenTrust, that's not a one day activity. Auditors have to be present, software has to be designed and tested, etc.

It's true that this shouldn't be done in a day, but it's trivial compared to building a command line tool that automatically configures HTTP servers and designing an open protocol that issues and renews certificates. This is especially true if one of your partners is a CA.

---

Let me be clear here: I'm not complaining that I don't get my free cake now. I do think however that most people at the EFF and Mozilla would agree that we needed something like this a couple of years ago. In that context I think it's a least noteworthy that they decided to wait until other parts of the system are ready.

Re: Launching in 2015: A Certificate Authority to Encrypt the Entire Web

#173

Post by tlb »

pbhjpbhj wrote: post #152
grey-area wrote: post #126

Earlier quoted context omitted.

Is there any reason why I would want to use https for this use case? Yes it can help you stop: ISPs inserting adverts into your content (this has happened) Governments censoring your content or rewriting it Governments putting people in jail for reading your publicly available (in your country) content, which is illegal in theirs People impersonating your website But if you don't want to use it, that's cool too. I su…

> Governments putting people in jail for reading your publicly available (in your country) content, which is illegal in theirs // How does that work, surely the gov can still see people accessing the information by monitoring network traffic and the info itself is still public. HTTPS doesn't encrypt the actual request traffic does it, and in any case the gov would still see which server the traffic is going to unless…

HTTPS does encrypt both request and response.

However, you can figure out what pages on a large public site like Wikipedia people are reading over HTTPS, based on statistical traffic analysis, because you can see the size of the request, page, and each of the images. Combined with link following analysis, you can make a fairly accurate guess as to what people are reading.

Re: Launching in 2015: A Certificate Authority to Encrypt the Entire Web

#174

Post by eyeareque »

BogdanCalin wrote: post #94
eyeareque wrote: post #52

This is great news, but I am wondering how they will handle revoking certificates. For example: Do we really want malware sites popping up with valid Ssl certificates?

You can revoke the certificates from the command line. It's shown at the end of the video.

Ah, so there aren't plans to add this CA into web browsers. That makes more sense.

Re: Launching in 2015: A Certificate Authority to Encrypt the Entire Web

#175

Post by kayone »

ademarre wrote: post #169

This is great news! I'd also like to see a push for technologies like DANE (and necessarily DNSSEC) which address the flawed CA trust model. While we're at it, let's get a non-profit domain registrar going.

> non-profit domain registrar

domain squatters are already an issue. imaging if you could register domains for free. I think having to pay $10 for a year is pretty fair. That's one reason I don't mind paying ~$70 for .io domain. it keeps most squatters away.

Re: Launching in 2015: A Certificate Authority to Encrypt the Entire Web

#176

Post by danielweber »

icebraining wrote: post #127
danielweber wrote: post #119

Earlier quoted context omitted.

Browsers shouldn't silently accept self-signed, but there is a class of servers where self-signed is the best we've got: connecting to embedded devices. If I want to talk to the new printer or fridge I got over the web, they have no way of establishing trust besides Tacking my first request to them.

Technically, there's no reason why a fridge couldn't have a signed cert tied to some dynamic DNS (e.g. . . ).

True, but on many small networks, you aren't addressing the embedded device by a FQDN.

All these appliances should let you change the cert on them, but you still need that initial connection, and at smaller organizations (or households) the certs will never ever be changed.

I used to work on embedded security projects so I care about this; I also realize that's a small portion of the market. I'm okay with making the people connecting to their new printer jump through a hoop in order to reduce the chances of someone hijacking www.paypal.comm but you still have to allow some way in.

Re: Launching in 2015: A Certificate Authority to Encrypt the Entire Web

#178

Post by thuejk »

ilaksh wrote: post #144

So this means that GoDaddy, Namecheap, Verisign and other sellers/resellers of SSL certificates will need to lower their prices soon, right? Because in a short time many websites won't need to purchase one since they can get it free. Also, have they built this system with a completely scalable distributed architecture? For it to be practical it needs to be performant. Also, does the NSA have access to the core of thi…

You can already get free certificates from startssl today: https://www.startssl.com/?app=1

Re: Launching in 2015: A Certificate Authority to Encrypt the Entire Web

#179

Post by M2Ys4U »

jbinto wrote: post #134
M2Ys4U wrote: post #113

Earlier quoted context omitted.

CA-signed certificates don't prove you're talking to who you think you are either as any CA trusted by your browser/OS can sign any certificate.

Yes. That's not perfect. But it raises the bar for forgery to "can sign certificates as a root authority", which is still fairly high. (e.g. I can't do it, and neither can you.) It stops coffee shop/hotel wifi operators and mobile providers from injecting content into your session. If we encourage users to blindly accept self-signed certificates (giving us end-to-end encryption but sacrificing identification), nothin…

You don't need a CA system to solve that problem, though. Take, for example, Convergence[0] which uses a notary system in place of the CA system.

[0] http://convergence.io

Re: Launching in 2015: A Certificate Authority to Encrypt the Entire Web

#180

Post by justcommenting »

from the ACME spec, it looks like proof of ownership is provided via[0]:

>Put a CA-provided challenge at a specific place on the web server

or

> Put a CA-provided challenge at a DNS location corresponding to the target domain.

Since the server will presumably be plaintext at that point and DNS is UDP, couldn't an attacker like NSA just mitm the proof-of-site-ownership functionality of lets-encrypt to capture ownership at TOFU and then silently re-use it, e.g. via Akamai's infrastructure?

[0] https://github.com/letsencrypt/acme-spec/blob/master/draft-b...

Post reply on HN