Let's Encrypt makes certs for 30% of web domains • Hacker News Board

Re: Let's Encrypt makes certs for 30% of web domains

#131

Post by kakwa_ » Sat, Sep 07, 2019, 10:26 AM UTC

kanox wrote: post #76

kakwa_ wrote: post #64

Earlier quoted context omitted.

Limiting a bit the impacts if Let's Encrypt is compromised in any way. If Let's encrypt is compromised, either by being able to issue certificate for arbitrary domains or if the CA itself is compromised, the impact would be huge given the current number of certificates signed by it and this number is likely to grow in the futur. With several CAs in different organizations, you have a far lower risk of seeing all the…

What exactly happens if a CA is compromised (private keys stolen etc)? Wouldn't existing certificates before the compromise date still be valid?

If a CA is compromised critically (private key stolen), then it's removed from the set of trusted CAs you can find in browsers or at OS level (ex: ca-certificates package on Ubuntu/Debian), which in turn makes all the certificates the CA has signed invalid.

With multiple signatures, at least, your certificate is still valid as it has at least another valid CA signature.

Also, right now, if one CA is compromised and if this goes unnoticed, the effect is a bit catastrophic as it's possible to create valid certificates for any domain. With multiple CA signatures in conjunction with a security policy mechanism stating how many of these signatures must be valid, you mitigate this issue as it would require several CAs to be compromised and controlled by the same actor to issue valid certificates.

Re: Let's Encrypt makes certs for 30% of web domains

#132

Post by doliveira » Sat, Sep 07, 2019, 11:09 AM UTC

manishsharan wrote: post #10

can someone please share how they deploy/distribute Let's encrypt certificates with auto renewal on load balanced multiple EC2 servers for the same dns name. I had tried this a while but had to give up and just bought SSL certs which I then include in my EC2 image.

I don't know if that is a good practice or whatnot, but I just set up .well-known in my nginx config to redirect to an S3 bucket where I write the ACME challenge to.

Re: Let's Encrypt makes certs for 30% of web domains

#133

Post by lucb1e » Sat, Sep 07, 2019, 12:13 PM UTC

bane wrote: post #117

Could be concerning, see https://blog.talosintelligence.com/2019/04/seaturtle.html

If you just want to post a link, I'd rather you submit a story with a title than put a "see, this is concerning:" in the comments.

Moreover, I don't see how this article is relevant to Let's Encrypt's popularity. There are only two mentions in the article about LE, this is one: "These actors use Let's Encrypts, Comodo, Sectigo, and self-signed certificates in their MitM servers to gain the initial round of credentials." So they use normal public infrastructure to get certificates? That is concerning, how?

Re: Let's Encrypt makes certs for 30% of web domains

#134

Post by daveheq » Sat, Sep 07, 2019, 1:35 PM UTC

The article says "Current SSL cert lifetime best practices put lifetimes at 90 days" but SSL is deprecated... so its lifetime best practice is 0 days.

Re: Let's Encrypt makes certs for 30% of web domains

#135

Post by asjid » Sat, Sep 07, 2019, 1:40 PM UTC

124

Re: Let's Encrypt makes certs for 30% of web domains

#136

Post by kumarm » Sat, Sep 07, 2019, 6:13 PM UTC

gator-io wrote: post #102

When LetsEncrypt came out, I wrote a service (free) that monitors LetsEncrypt certs externally and sends alerts when they are close to expiring. It can be used as a backup to the automatic emails that are sent: https://letsmonitor.org

Nice. Couple of things:

1. Why not integrate and let user monitor all their SSL certs for a domain in a single shot? Like retrieve all certs for a domain (similar to https://crt.sh identity like search result)

2. When registered, I did not receive an email confirmation/validation. So I am not sure if I will get an email before my certs are up for renewal.

Re: Let's Encrypt makes certs for 30% of web domains

#137

Post by tracker1 » Sat, Sep 07, 2019, 10:22 PM UTC

nickpsecurity wrote: post #107

They give away paid products for free. Products that Google penalizes you for not having. Then, many people needing or wanting that product used their free alternative. I still don’t know if that vs version with more paying customers is a good thing in long run. Good for now, though.

In practice, most CAs are over-charging for what should be highly automated (like LE). Other CAs also push EV and other certs that cost more, but don't really add much value in practice.

In the end, the "free" version is good enough for most people. I would suggest if you're using it in a commercial environment that you consider setting up a scheduled donation. Which likely does help a lot for what they are doing.

Re: Let's Encrypt makes certs for 30% of web domains

#138

Post by bane » Sun, Sep 08, 2019, 2:34 AM UTC

lucb1e wrote: post #133

bane wrote: post #117

Could be concerning, see https://blog.talosintelligence.com/2019/04/seaturtle.html

If you just want to post a link, I'd rather you submit a story with a title than put a "see, this is concerning:" in the comments. Moreover, I don't see how this article is relevant to Let's Encrypt's popularity. There are only two mentions in the article about LE, this is one: "These actors use Let's Encrypts, Comodo, Sectigo, and self-signed certificates in their MitM servers to gain the initial round of credential…

You are most welcome.

Re: Let's Encrypt makes certs for 30% of web domains

#139

Post by blackflame7000 » Sun, Sep 08, 2019, 4:10 AM UTC

jaas wrote: post #39

patmorgan23 wrote: post #28

Earlier quoted context omitted.

Yeah the software is open source, any other CA has the ability to pick it up ajd implement a similar service.

Just so people don't get an oversimplified view of what it takes to start a CA from this comment, you will have much bigger challenges than access to application software. Your first issue will be securing millions of dollars per year for the staff that it takes to run the CA responsibly. Your next issue will be getting trusted by browsers. Also, the open source Let's Encrypt CA software is tailored for how we do thi…

For the record, not even the DoD can get their CA credentials approved as of right now because some existing certs where still using SHA1 signatures

Re: Let's Encrypt makes certs for 30% of web domains

#140

Post by MertsA » Sun, Sep 08, 2019, 6:41 AM UTC

buboard wrote: post #125

Biganon wrote: post #123

Earlier quoted context omitted.

That's not the point. In a decentralized system, every actor needs an incentive to mine new blocks in the chain. In cryptocurrencies, the incentive is the creation of new money attached to your name. But what if we're not dealing with a currency, but something else?

you are thinking of bitcoin. there are many different blockchain setups . and there is already namecoin

The whole point of providing an incentive is to give a bunch of decentralized miners a reason to devote a reasonable amount of processing power to securing the blockchain. If there's only a single non-profit mining the chain, because why on earth would a bunch of other people throw money away for no reward, then for an attacker it's substantially more feasible to perform a 51% attack.

For Bitcoin there's currently around $132,000 of incentive for mining given out every 10 minutes. In a race to the bottom that basically equates to a bit under $132,000 worth of compute resources expended for mining every 10 minutes. An attacker with enough resources to perform an attack on Bitcoin would have to spend more than that $132,000 every 10 minutes and keep it up for the duration of their attack.

"Blockchain" for random hip projects more often than not is just buzzword nonsense that does nothing to improve security. A blockchain without mining is just silly, mining only works when it provides sufficient incentive such that attacking that blockchain is much more expensive than any payoff of attacking it is worth.