Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

10 Years of Let's Encrypt

letsencrypt.org

Post reply on HN
Print view View original

171–180 of 361 posts

Re: 10 Years of Let's Encrypt

#171

Post by crote »

wbl wrote: post #165
duskwuff wrote: post #130

Earlier quoted context omitted.

Which would have made sense if company names were unique - which they aren't. See e.g. https://groups.google.com/g/mozilla.dev.security.policy/c/Nj... for an example of how this was abused.

It was used correctly. What CAs wanted to sell wasn't something browsers wanted to support, and EV was the compromise. It just happens that what EV meant wasn't that useful irl.

What's the alternative, showing the company's unique registration ID?

CAs invented EVs because the wanted to sell something which could make them more money than DVs. The fact that company names aren't unique means that the whole concept was fundamentally flawed from the start: there is no identifier which is both human-readable and guaranteed to uniquely identify an entity. They wanted to sell something which can't exist. The closest thing we have got is... domain names.

Re: 10 Years of Let's Encrypt

#172

Post by letsgetreal »

ekr____ wrote: post #156
letsgetreal wrote: post #129

Earlier quoted context omitted.

The "most people won't care argument" doesn't inspire confidence in the authenticity of the website. It's essentially a self-signed cert that anyone could make with the false security of a root certificate authority.

This isn't correct. There are two authentication properties that one might be interested in: 1. The binding of some real world identity (e.g., "Google") to the domain name ("google.com). 2. The binding of the domain name to a concrete Web site/connection. The WebPKI is responsible for the second of these but not the first, and ensures that once you have the correct domain name, you are talking to the right site. This…

Nothing mentioned will help for a website with a Let's Encrypt SSL cert. How can I know with confidence that I can conduct commerce with this website that purports to be the company and it's not a typo squatter from North Korea? A google search doesn't cut it. Nothing in this thread has answered that basic question.

It's a non-issue for DigiCert and Sectigo certs. I can click on the certs and see for myself that they're genuine.

Re: 10 Years of Let's Encrypt

#173

Post by [deleted] »

charlesbarbier wrote: post #93
jsheard wrote: post #46

Earlier quoted context omitted.

It's not like Let's Encrypt is the only game in town, Actalis in Italy provides free ACME certs too if you'd prefer to keep things in Europe.

Not sure if there is a point to "keep things in Europe" when it come to certificate authority. - LetsEncrypt don't have the private key tied to your certificate - Any of the Certificate Authorities could potentially emit unauthorized certificate Your only protection for all of these problems is HPKP. If you prefer to keep things in Europe, keep that pinned private key in Europe, but the rest doesn't matter. That said…

[deleted]

Re: 10 Years of Let's Encrypt

#174

Post by crote »

greyface- wrote: post #32
ekr____ wrote: post #26

Earlier quoted context omitted.

Can you elaborate a bit about what you mean by "the blessing of a CA"? I agree that it's true that you need a certificate to do TLS, but importantly Let's Encrypt isn't interested in what you do with your certificate, just that you actually control the domain name. See: https://letsencrypt.org/2015/10/29/phishing-and-malware.html

Their policy today is to grant certificates liberally. There is no technical guarantee that this remains the case indefinitely, only a political one. I don't doubt the sincerity of this guarantee, but I wish I didn't have to rely on it.

A big factor is that they are serving so many certs, with only a tiny amount of funding. Anything beyond the most basic pre-written list of blocked domain names is infeasible. Analyzing the content of every single domain would increase their resource needs by several orders of magnitude. That's reasonably close to a technical guarantee, if you ask me.

Re: 10 Years of Let's Encrypt

#175

Post by tialaramex »

charcircuit wrote: post #162
foresto wrote: post #109

Earlier quoted context omitted.

Unfortunately, placing the information on a social media page burdens the people seeking it with either submitting to the social media site's policies and practices, or else not having access to it. This is not a good substitute. It also contributes to the centralization of the web, placing more information under the control of large gatekeepers, and as a side effect, giving those gatekeepers even more influence.

Most social media are free and easy to sign up for taking under a minute to do and have user bases that can be measured in the billions. Most people in the world are willing to follow the rules. Most people don't use social media via the web. They use it via dedicated apps. I think it's natural that people who don't want to deal with the tech side of things will outsource it to someone else. The idea that everyone wi…

For now, in some jurisdictions, social media is "free" for your customers in the sense that it's supported by advertising.

It's not free for you of course because advertising isn't free and from their point of view what you'd be getting is free advertising so they want you to pay them to put it in front of your customers.

Re: 10 Years of Let's Encrypt

#176

Post by crote »

p2detar wrote: post #41
hulitu wrote: post #18

> 10 Years of Let's Encrypt Aren't they only 45 days [1] old ? [1] https://letsencrypt.org/2025/12/02/from-90-to-45

Not sure if you're joking or not, but I have to deal with this upcoming change at some point and still haven't read in detail why they decided to do this. Could anyone clarify?

Because big companies have a habit of growing layers of bureaucracy. If a cert is valid for three years, a decent bunch of them will invent a three-month process around cert renewal, involving two dozen stakeholders, several meetings, and sign-off from the CTO.

The side-effect of this is that they become incapable of doing it any faster during an emergency. Private key compromised? Renewal takes two months, so better hope the attackers can't do too much damage before that. CAs in turn have large (=profitable) customers which such processes who they really don't want to lose, so historically when they've failed to renew in time during incidents CAs have granted those customers exceptions on the revocation rules because they are "business critical" and doing it by-the-book would cause "significant harm". No CA is willing to be strict, because they'd lose their most valuable customers to their competition.

The only way to solve this is to force companies into adopting efficient renewal processes via an industry-wide reduction of certificate validity time. When you have to renew once a month you can't afford to have a complicated process, so you end up automating it, so there's no reason for CAs to delay cert revocation during incidents, so the internet is more secure. And because every CA is doing it, companies don't gain anything by switching to more lenient CAs, so the individual CAs have no incentive to violate the industry rules by delaying revocation.

Re: 10 Years of Let's Encrypt

#177

Post by tptacek »

mmooss wrote: post #138

Another amazing success born at Mozilla: "The Let's Encrypt project was started in 2012 by two Mozilla employees, Josh Aas and Eric Rescorla, together with Peter Eckersley at the Electronic Frontier Foundation and J. Alex Halderman at the University of Michigan." https://en.wikipedia.org/wiki/Let%27s_Encrypt What was Mozilla's role, beyond conception? Parenting? Care and feeding? A roof?

You can ask them; both Josh and Eric are HN people, and Erik is already on this thread. :)

Re: 10 Years of Let's Encrypt

#178

Post by winternett »

jjice wrote: post #5

Let's Encrypt was _huge_ in making it's absurd to not have TLS and now we (I, at least) take it for granted because it's just the baseline for any website I build. Incredible, free service that helped make the web a more secure place. What a wonderful service - thank you to the entire team. The CEO at my last company (2022) refused to use Let's Encrypt because "it looked cheap to customers". That is absurd to me beca…

Many host providers (Those acquired by companies like Web.Com, allegedly) disable all ability to use outside certs since Google made encryption a requirement in Chrome Browser...

They do things like blocking containers & SSH to make installing free certs impossible.

They also have elevated the price of their own certs (that they can conveniently provide) to ridiculous prices in contrast to free certs their customers can't even use...

It would be a huge price-fixing scandal if Congress had any idea of how technology works.

Re: 10 Years of Let's Encrypt

#179

Post by tptacek »

letsgetreal wrote: post #172
ekr____ wrote: post #156

Earlier quoted context omitted.

This isn't correct. There are two authentication properties that one might be interested in: 1. The binding of some real world identity (e.g., "Google") to the domain name ("google.com). 2. The binding of the domain name to a concrete Web site/connection. The WebPKI is responsible for the second of these but not the first, and ensures that once you have the correct domain name, you are talking to the right site. This…

Nothing mentioned will help for a website with a Let's Encrypt SSL cert. How can I know with confidence that I can conduct commerce with this website that purports to be the company and it's not a typo squatter from North Korea? A google search doesn't cut it. Nothing in this thread has answered that basic question. It's a non-issue for DigiCert and Sectigo certs. I can click on the certs and see for myself that they…

No you can't. Even during the EV years, clowning an EV cert was more like a casual stunt for researchers than an actual disclosable event. In reality, there's nothing DigiCert is meaningfully doing to assure you about "conducting commerce" on sites.

Re: 10 Years of Let's Encrypt

#180

Post by Sohcahtoa82 »

winternett wrote: post #178
jjice wrote: post #5

Let's Encrypt was _huge_ in making it's absurd to not have TLS and now we (I, at least) take it for granted because it's just the baseline for any website I build. Incredible, free service that helped make the web a more secure place. What a wonderful service - thank you to the entire team. The CEO at my last company (2022) refused to use Let's Encrypt because "it looked cheap to customers". That is absurd to me beca…

Many host providers (Those acquired by companies like Web.Com, allegedly) disable all ability to use outside certs since Google made encryption a requirement in Chrome Browser... They do things like blocking containers & SSH to make installing free certs impossible. They also have elevated the price of their own certs (that they can conveniently provide) to ridiculous prices in contrast to free certs their customers…

There are literally thousands of web hosts out there. If your web host is doing something shitty like that, it's trivial to find a new one.
Post reply on HN