Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

10 Years of Let's Encrypt

letsencrypt.org

Post reply on HN
Print view View original

161–170 of 361 posts

Re: 10 Years of Let's Encrypt

#161

Post by crote »

bostik wrote: post #45
quesera wrote: post #33

Earlier quoted context omitted.

I've never seen (noticed) an OV cert in real life, and no business I've ever been responsible for pushed for OV over DV. It was always EV or "huh?"

I think I've seen one or two, and only because I noticed them as a weird callout in a $LARGE_FINANCE_INSTITUTION infosec bingo sheet. Of course I had to check that they really were running with OV certs. Some of the outfits in that space will be heavily hit by the shortening certificate max-lifetimes, and I do hope that the insurance companies at some point also stop demanding a cert rotation before 90 days to expiry…

> I do hope that the insurance companies at some point also stop demanding a cert rotation before 90 days to expiry

It's not like you have a lot of choices when certificates are only valid for 47 days in 2029!

Re: 10 Years of Let's Encrypt

#162

Post by charcircuit »

foresto wrote: post #109
charcircuit wrote: post #103

Earlier quoted context omitted.

This is why more and more organizations get away with only having social media pages where they don't have to worry about security or other technical issues.

Unfortunately, placing the information on a social media page burdens the people seeking it with either submitting to the social media site's policies and practices, or else not having access to it. This is not a good substitute. It also contributes to the centralization of the web, placing more information under the control of large gatekeepers, and as a side effect, giving those gatekeepers even more influence.

Most social media are free and easy to sign up for taking under a minute to do and have user bases that can be measured in the billions. Most people in the world are willing to follow the rules.

Most people don't use social media via the web. They use it via dedicated apps. I think it's natural that people who don't want to deal with the tech side of things will outsource it to someone else. The idea that everyone will host their own tech is unrealistic.

Re: 10 Years of Let's Encrypt

#163

Post by crapple8430 »

t1234s wrote: post #87

Lets hope they stay independent and never get acquired by Google or any other large tech company. You can imagine a web where SSL issuance is used as a tool to censor websites. I think most browsers have been made to make standard http sites look malicious to normal users.

If Google wants to censor your website, they have a variety of other, more effective methods, like by adding it to their safe browsing blacklist, which is also used in many Firefox installs.

Re: 10 Years of Let's Encrypt

#164

Post by array_key_first »

anonymars wrote: post #69
xxmarkuski wrote: post #48

Earlier quoted context omitted.

I have heard, but do not aggree, that Let‘s Encrypt is risky, because phishing sites use it. It’s implied that other CAs do checks against it.

I will say, I have never before this season seen so many seemingly-legit fake web stores. All with their little lock icons in the address bar. I assume LLMs helped kick it into overdrive too

Conflating transport-layer encryption with authenticity is the problem. The former should always be standard, the latter is unrelated and IMO needs a different mechanism.

Re: 10 Years of Let's Encrypt

#165

Post by wbl »

duskwuff wrote: post #130
realityking wrote: post #89

Earlier quoted context omitted.

EV certs also showed the legal name of the company that requested the certificate - that was an advantage.

Which would have made sense if company names were unique - which they aren't. See e.g. https://groups.google.com/g/mozilla.dev.security.policy/c/Nj... for an example of how this was abused.

It was used correctly. What CAs wanted to sell wasn't something browsers wanted to support, and EV was the compromise. It just happens that what EV meant wasn't that useful irl.

Re: 10 Years of Let's Encrypt

#166

Post by BHSPitMonkey »

wnevets wrote: post #142
AlbinoDrought wrote: post #141

Earlier quoted context omitted.

I'd love a referral to your certificate authority and rep - we go through a big kerfluffle each renewal period, only eventually receiving the certificate after a long exchange of government docs and CPA letters. For us, only the last step is the phonecall like you say.

The replies to my original comment make it obvious who has gotten an EV cert from a quality CA before and who hasn't.

This exchange seemingly proves the argument that user trust gained from the EV treatment is misplaced, and that the endeavor was a farce all along. It's not as though the user's browser was distinguishing the good CAs from the bad!

Re: 10 Years of Let's Encrypt

#167

Post by crote »

mschuster91 wrote: post #35
Analemma_ wrote: post #19

Earlier quoted context omitted.

I've seen people complain that Let's Encrypt is so easy that it's enabling the forced phaseout of long-lived certificates and unencrypted HTTP. I sort of understand this, although it does feel like going "bcrypt is so easy to use it's enabling standards agencies to force me to use something newer than MD5". Like, yeah, once the secure way is sufficiently easy to use, we can then push everyone off the insecure way; th…

> Like, yeah, once the secure way is sufficiently easy to use, we can then push everyone off the insecure way; that's how it's supposed to work. The problem is that this requires work and validation, which no beancounter ever plans for. And the underlings have to do the work, but don't get extra time, so it has to be crammed in, condensing the workday even more. For hobbyist projects it's even worse. That is why peop…

We've reached a point where securing your hobby projects essentially means setting the "use_letsencrypt = true" config option in your web server. I bet configuring it takes less time than you spent reading this HN thread.

And with regards to the beancounters: that is exactly why the browsers are pushing for it. Most companies aren't willing time and effort into proper certificate handling procedures. The only way to get them to secure their shit is by forcing them: do it properly, or your website will go offline. And as it turns out, security magically gets a lot more attention when ignoring it has a clear and direct real-world impact.

Re: 10 Years of Let's Encrypt

#168

Post by noAnswer »

asim wrote: post #36

As a sysadmin in the 2007-2011 timeframe I literally used openssl to generate csrs, went to godaddy to purchase SSL certificates and then manually deployed them to servers. Man what a world of change. Let's encrypt is one the best services we've had on the internet. I wish we had more things like this.

Would be cool to have it for S/MIME too.

Re: 10 Years of Let's Encrypt

#170

Post by foresto »

cortesoft wrote: post #147
foresto wrote: post #90

Earlier quoted context omitted.

I can understand this in in certain contexts, such as a site that exists solely to post public information of no value to an attacker. A local volunteer group that posts their event schedule to the web were compelled to take on the burden of https just to keep their site from being labeled as a potential threat. They don't have an IT department. They aren't tech people. The change multiplied the hassles of maintainin…

The work and technical expertise to setup let's encrypt is less than the work to register a domain, set up a web server, and configure DNS to point to it.

You seem to have missed what I wrote in the first place: They aren't tech people.

It is additional work, and requires additional knowledge.

It was also not available from most of the free web hosts that sites like these used before the https push. So investigating alternatives and migrating were required. In other words, still more work.

Post reply on HN