Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Our First Certificate Is Now Live

letsencrypt.org

Post reply on HN
Print view View original

171–180 of 263 posts

Re: Our First Certificate Is Now Live

#171

Post by duskwuff »

cbg0 wrote: post #167
simula67 wrote: post #164

Sorry for asking a potentially dumb question : but is it possible for me to set up a domain name thecitibank.com and ask letsencrypt to issue me a certificate ? I can then create a login page to steal IPINs. Isn't that why we have humans in the loop for issuing certificates ?

Actually it's automated in most places, simply requiring you to confirm a request via an e-mail address associated with the domain you're getting an SSL for (typically admin@ hostmaster@ webmaster@, though it varies between certificate providers).

Most of the reputable CAs have some practices in place to check for keywords related to big brands and auto-reject certificate requests. (So you can't get a certificate for "login-facebook.com" or whatnot, for instance.)

Re: Our First Certificate Is Now Live

#172

Post by stephenr »

simula67 wrote: post #164

Sorry for asking a potentially dumb question : but is it possible for me to set up a domain name thecitibank.com and ask letsencrypt to issue me a certificate ? I can then create a login page to steal IPINs. Isn't that why we have humans in the loop for issuing certificates ?

As has been said, existing domain-validated (i.e. basic) certificates are automated anyway.

The type of certificate that banks etc use are EV - Extended Validation. This means the organisation details are verified as well, and as such the browser displays the verified organisation name in green in some cases, instead of any host/url at all).

Re: Our First Certificate Is Now Live

#173

Post by alcari »

kojoru wrote: post #161
alcari wrote: post #88

Earlier quoted context omitted.

It's scary how easy it is to add new roots on all major platforms. You just click on the CA link and get a response with the appropriate MIME type back, then: * Windows gives you a helpful little wizard wherein you click "next" a few times. * Firefox gives you a dialog with 3 checkboxes; check them and click okay. * iOS sends you to settings, and asks you if you want to trust the given CA. * OS X hands it to Keychain…

You're incorrect about Windows. If you just click next several times the cert will not be added to trusted. To do that you'll have to override default settings in a non trivial way (deselect "Choose cert store automatically" and select the correct cert store) on one of the steps I'm sure that's intentional design

Maybe it changed at some point (8?), or my memory's fuzzy. I haven't looked at it in several years.

Either way, trusting a root CA generally looks far less threatening than the self-signed certificate warnings.

Re: Our First Certificate Is Now Live

#174

Post by chetanahuja »

duskwuff wrote: post #171
cbg0 wrote: post #167

Earlier quoted context omitted.

Actually it's automated in most places, simply requiring you to confirm a request via an e-mail address associated with the domain you're getting an SSL for (typically admin@ hostmaster@ webmaster@, though it varies between certificate providers).

Most of the reputable CAs have some practices in place to check for keywords related to big brands and auto-reject certificate requests. (So you can't get a certificate for "login-facebook.com" or whatnot, for instance.)

There's no requirement in the spec for using "reputable" CA's for certificates.

Re: Our First Certificate Is Now Live

#175

Post by mortenlarsen »

kuschku wrote: post #158
chrissnell wrote: post #151

Earlier quoted context omitted.

Back in the day, running a massive library of fonts slowed down many apps. Is this still the case? I'm running Mac OS X 10.10.

I’m on linux, and yes, it does. Opening the font selection menu can take for me, with 7000 installed fonts, about half an hour sometimes. I just don’t do that, instead select fonts by name (I know most of them now). But you don’t notice it until you open a font selection menu.

Also on Ubuntu. I (only) have 671 fonts, no delay at all for me.

Re: Our First Certificate Is Now Live

#176

Post by johnnydoebk »

duskwuff wrote: post #171
cbg0 wrote: post #167

Earlier quoted context omitted.

Actually it's automated in most places, simply requiring you to confirm a request via an e-mail address associated with the domain you're getting an SSL for (typically admin@ hostmaster@ webmaster@, though it varies between certificate providers).

Most of the reputable CAs have some practices in place to check for keywords related to big brands and auto-reject certificate requests. (So you can't get a certificate for "login-facebook.com" or whatnot, for instance.)

Could you provide a few examples of reputable and not so reputable CAs?

Re: Our First Certificate Is Now Live

#177

Post by chetanahuja »

Russell91 wrote: post #169
simula67 wrote: post #164

Sorry for asking a potentially dumb question : but is it possible for me to set up a domain name thecitibank.com and ask letsencrypt to issue me a certificate ? I can then create a login page to steal IPINs. Isn't that why we have humans in the loop for issuing certificates ?

This comment is the exact perception about HTTPS that we need to change. It's not the job of HTTPS to say whether a website is safe or unsafe, good or bad. HTTPS should be the default communication protocol for every website, and lets encrypt move us a major step towards that by making SSL certificates free and trivial to set up.

"This comment is the exact perception about HTTPS that we need to change. It's not the job of HTTPS to say whether a website is safe or unsafe."

Too late. The web industry has spent about 20 years training regular people to look for that green lock sign in the address bar and feel all warm and fuzzy about how safe the site is. You can post on hacker news all you want about what perceptions need to be changed. It's not going to change the ground reality. SSL, as practiced in the industry today with all it's historical baggage is fundamentally broken. There's no fixing it.

Re: Our First Certificate Is Now Live

#178

Post by creshal »

simula67 wrote: post #164

Sorry for asking a potentially dumb question : but is it possible for me to set up a domain name thecitibank.com and ask letsencrypt to issue me a certificate ? I can then create a login page to steal IPINs. Isn't that why we have humans in the loop for issuing certificates ?

Yes, you can.

You can also do the same at every existing CA that provides domain verified certificates. From personal experience neither StartSSL nor Comodo have a human in the look – until you want more than domain verification (e.g., "green bar" EV certificates).

Re: Our First Certificate Is Now Live

#179

Post by chetanahuja »

duskwuff wrote: post #171
cbg0 wrote: post #167

Earlier quoted context omitted.

Actually it's automated in most places, simply requiring you to confirm a request via an e-mail address associated with the domain you're getting an SSL for (typically admin@ hostmaster@ webmaster@, though it varies between certificate providers).

Most of the reputable CAs have some practices in place to check for keywords related to big brands and auto-reject certificate requests. (So you can't get a certificate for "login-facebook.com" or whatnot, for instance.)

"(So you can't get a certificate for "login-facebook.com" or whatnot, for instance.)"

You mean not from one of those "reputable" CAs. But really, why would I go to a "reputable" CA for my deceptive certificate if my intent is not so reputable?

Re: Our First Certificate Is Now Live

#180

Post by cpach »

pakitan wrote: post #168
simula67 wrote: post #164

Sorry for asking a potentially dumb question : but is it possible for me to set up a domain name thecitibank.com and ask letsencrypt to issue me a certificate ? I can then create a login page to steal IPINs. Isn't that why we have humans in the loop for issuing certificates ?

A valid certificate only allows you to have a secure connection without errors and warnings popping up all over. It does nothing to guarantee that the domain is "legit". You can already set up thecitibank.com and get an SSL certificate for it without any problem. What you can't do is get the EV (green bar) certificate where indeed you need to go through a human. But I'm pretty sure Let's Encrypt won't be giving away…

”without any problem”

Are you sure about that?

Post reply on HN