Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

10 Years of Let's Encrypt

letsencrypt.org

Post reply on HN
Print view View original

131–140 of 361 posts

Re: 10 Years of Let's Encrypt

#131

Post by fpoling »

monerozcash wrote: post #107
wnevets wrote: post #68

Earlier quoted context omitted.

> In addition to all of the authentication steps CAs take for DV and OV certificates, EV certificates require vetting of the business organization’s operational existence, physical address and a telephone call to verify the employment status of the requestor. [1] [1] https://www.digicert.com/difference-between-dv-ov-and-ev-ssl... Tying a phone number to a physical address and company is a lot more useful than just pr…

It was easy to provide the information for an existing business you're completely unrelated to. Reliably verifying that a person actually represents a company isn't possible in most of the world.

Many countries has official register of companies with at least post box address. Requiring to answer a physical letter sent to an address from the central register will be much more reliable.

Re: 10 Years of Let's Encrypt

#132

Post by mcpherrinm »

everfrustrated wrote: post #115
bifurcation wrote: post #92

Earlier quoted context omitted.

Hi there, ISRG co-founder and current board member here. In brief, shorter lifetimes force people to automate (which, e.g., avoids outages from manual processes) and mitigates the broken state of revocation in the Web PKI. That latter point especially is what I understand to be driving the Web PKI toward ever-shorter lifetimes. I actually remember the discussion we had in ~2014 about what the default certificate life…

With the move to ever shorter certs the risk to letsencrypt having an outage is higher. It would be nice to read more about what the organization is doing around resilience engineering so we can continue to be confident in depending on it issuing renewals in time. Do you publish any of this? DR plans? Etc. I don't mean for this to be a negative - really impressed by LE - but we've had a lot of Cloudflare outages rece…

I'm the technical lead for Let's Encrypt SRE.

Publishing more about our resilience engineering sounds like a great idea!

I'll get that on our blogging schedule for next year

Re: 10 Years of Let's Encrypt

#133

Post by tptacek »

schoen wrote: post #123
tptacek wrote: post #112

Earlier quoted context omitted.

It was never a reasonable goal of the WebPKI to authenticate entities; only to help establish end-to-end encryption between unrelated parties on the Internet. The WebPKI can ensure you're talking to whoever controls `ycombinator.com`, but it has to be up to some other layer of the security stack to decide whether you want to be talking to `ycombinator.com`. (This is in fact part of the logic behind FIDO2 and phishing…

> It was never a reasonable goal of the WebPKI to authenticate entities The confusing thing is that this goal nonetheless appeared in some original marketing and explanations about the web PKI from the late 1990s when it was first introduced. There was another smaller burst of this when people were arguing over the formalization of DV certificates and of Google's UI changes that stopped treating EV specially (as some…

Right, and when people who haven't paid that much attention to the machinations of the WebPKI (who could blame them) talk about how weird it is that the browsers killed EV, this is an important part of the backstory: EV was mostly a failed attempt to make the WebPKI do this kind of "do-what-I-mean" entity authentication.

The problem as I see it is: there simply isn't one coherent global notion of what entity authentication means. It's situational.

Re: 10 Years of Let's Encrypt

#134

Post by tptacek »

letsgetreal wrote: post #122
tptacek wrote: post #112

Earlier quoted context omitted.

It was never a reasonable goal of the WebPKI to authenticate entities; only to help establish end-to-end encryption between unrelated parties on the Internet. The WebPKI can ensure you're talking to whoever controls `ycombinator.com`, but it has to be up to some other layer of the security stack to decide whether you want to be talking to `ycombinator.com`. (This is in fact part of the logic behind FIDO2 and phishing…

FIDO2 doesn't solve the first website contact trust problem - only the HTTPS certificate does that.

It's good to want things!

Re: 10 Years of Let's Encrypt

#135

Post by tptacek »

schoen wrote: post #117
tptacek wrote: post #73

Earlier quoted context omitted.

This is a retcon. Facebook rolled out TLS in 2011, 2 years before Snowden, and went TLS-by-default within a month of the Snowden disclosures. Google Mail was TLS-by-default in 2010. TLS was a universal best practice long before 2013 --- by 2010, you'd have gotten a sev:hi vulnerability flagged on your site if you hadn't implemented TLS. SSLLabs was 2009; BEAST was 2011, and was a huge global news story because of how…

I think you're right that this consensus was clearly emerging then (I remember Firesheep in 2010 as another big identifiable contributing factor), but I remember actively asking smaller sites to enable HTTPS in that era, and they would often refuse. So I think Snowden also contributed to the spread of the norm. It is possible that there's a retcon element, because it's not always clear in my memory exactly what year…

I think it would be a stretch to say that Snowden did nothing to accelerate the uptake; for better and worse he clearly did. But he didn't set it into motion; we were going to have an all-TLS Internet within a decade with or without him.

Re: 10 Years of Let's Encrypt

#136

Post by nottorp »

eastbound wrote: post #75
nottorp wrote: post #62

Earlier quoted context omitted.

> but personal blogs and the likes? Yep, the result of the current security hysteria/theater is it makes it increasingly difficult to maintain an independent web presence. Yes, I know, you can just use Cloudflare and depend on it...

Cloudflare uses HTTP to connect to your website before caching the content. I’ve always found it highly insecure. You could have HTTPS with Letsencrypt, but you need to deactivate Cloudflare when you want to renew (or use the other validation that is complex enough that I didn’t succeed to do it).

Don't pick on this particular SSL requirement, pick on the deluge of requirements that only make sense for a site that sells something or handles personal data (i.e. has accounts). They get extended to $RANDOM_SITE that only serves static text and the occasional cat photo for no good reason except "your cats will be more secure!".

Re: 10 Years of Let's Encrypt

#137

Post by callumgare »

Decoy1008 wrote: post #31

I am so grateful for this. Bummer that they stopped with the email reminder, anyways I was wondering how this would work without active payments. Still amazing.

Out of interest why do you care? I assume you’re using acme to automate renewals. Is it in case that fails? Or do you work with some system that can’t be automated?

Re: 10 Years of Let's Encrypt

#138

Post by mmooss »

Another amazing success born at Mozilla:

"The Let's Encrypt project was started in 2012 by two Mozilla employees, Josh Aas and Eric Rescorla, together with Peter Eckersley at the Electronic Frontier Foundation and J. Alex Halderman at the University of Michigan."

https://en.wikipedia.org/wiki/Let%27s_Encrypt

What was Mozilla's role, beyond conception? Parenting? Care and feeding? A roof?

Re: 10 Years of Let's Encrypt

#139

Post by rplnt »

Analemma_ wrote: post #19
jjice wrote: post #5

Let's Encrypt was _huge_ in making it's absurd to not have TLS and now we (I, at least) take it for granted because it's just the baseline for any website I build. Incredible, free service that helped make the web a more secure place. What a wonderful service - thank you to the entire team. The CEO at my last company (2022) refused to use Let's Encrypt because "it looked cheap to customers". That is absurd to me beca…

I've seen people complain that Let's Encrypt is so easy that it's enabling the forced phaseout of long-lived certificates and unencrypted HTTP. I sort of understand this, although it does feel like going "bcrypt is so easy to use it's enabling standards agencies to force me to use something newer than MD5". Like, yeah, once the secure way is sufficiently easy to use, we can then push everyone off the insecure way; th…

Random anecdote: I have a device in which the http client can't handle https. Runs out of memory and crashes. Wasn't able to find a free host with a public http to host a proxy.

Re: 10 Years of Let's Encrypt

#140

Post by smurda »

btown wrote: post #24
jjice wrote: post #5

Let's Encrypt was _huge_ in making it's absurd to not have TLS and now we (I, at least) take it for granted because it's just the baseline for any website I build. Incredible, free service that helped make the web a more secure place. What a wonderful service - thank you to the entire team. The CEO at my last company (2022) refused to use Let's Encrypt because "it looked cheap to customers". That is absurd to me beca…

To be fair, for a CEO in 2022, EV certificates had only lost their special visualizations since September/October 2019 with Chrome 77 and Firefox 70 - and with all that would happen in the following months, one could be forgiven for not adapting to new browser best practices! https://www.troyhunt.com/extended-validation-certificates-ar...

I loved the visualization of EV certs in browsers, but in 2014 vendors like GoDaddy charged $100/yr for them. https://web.archive.org/web/20131023033903/http://www.godadd...

I'm glad LE, browsers, and others like Cloudflare brought this cost to $0. Eliminating this unnecessary cost is good for the internet.

Post reply on HN