Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Our First Certificate Is Now Live

letsencrypt.org

Post reply on HN
Print view View original

181–190 of 263 posts

Re: Our First Certificate Is Now Live

#181

Post by XorNot »

chetanahuja wrote: post #177
Russell91 wrote: post #169

Earlier quoted context omitted.

This comment is the exact perception about HTTPS that we need to change. It's not the job of HTTPS to say whether a website is safe or unsafe, good or bad. HTTPS should be the default communication protocol for every website, and lets encrypt move us a major step towards that by making SSL certificates free and trivial to set up.

"This comment is the exact perception about HTTPS that we need to change. It's not the job of HTTPS to say whether a website is safe or unsafe." Too late. The web industry has spent about 20 years training regular people to look for that green lock sign in the address bar and feel all warm and fuzzy about how safe the site is. You can post on hacker news all you want about what perceptions need to be changed. It's no…

Actually what's really broken is the way we've approached implementations. Recently I was trying to get a self-signed certificate for myself trusted by Python urllib3...I still don't know how to do it. It uses a completely separate trust-store. As does half a dozen other things on my system.

Re: Our First Certificate Is Now Live

#182

Post by dtech »

cpach wrote: post #180
pakitan wrote: post #168

Earlier quoted context omitted.

A valid certificate only allows you to have a secure connection without errors and warnings popping up all over. It does nothing to guarantee that the domain is "legit". You can already set up thecitibank.com and get an SSL certificate for it without any problem. What you can't do is get the EV (green bar) certificate where indeed you need to go through a human. But I'm pretty sure Let's Encrypt won't be giving away…

”without any problem” Are you sure about that?

Most certificate providers are already fully automated, the personal identity (not domain ownership) verification is the only human part.

Re: Our First Certificate Is Now Live

#183

Post by vacri »

chetanahuja wrote: post #177
Russell91 wrote: post #169

Earlier quoted context omitted.

This comment is the exact perception about HTTPS that we need to change. It's not the job of HTTPS to say whether a website is safe or unsafe, good or bad. HTTPS should be the default communication protocol for every website, and lets encrypt move us a major step towards that by making SSL certificates free and trivial to set up.

"This comment is the exact perception about HTTPS that we need to change. It's not the job of HTTPS to say whether a website is safe or unsafe." Too late. The web industry has spent about 20 years training regular people to look for that green lock sign in the address bar and feel all warm and fuzzy about how safe the site is. You can post on hacker news all you want about what perceptions need to be changed. It's no…

Green lock = EV cert. People are trained to look for the green, not for the lock - few people other than techies even look for a grey lock. EV certs generally have much more stringent requirements than "hey, give me a cert!".

Re: Our First Certificate Is Now Live

#184

Post by nailer »

kuschku wrote: post #82
nailer wrote: post #63

Earlier quoted context omitted.

I run https://certsimple.com : we only do EV certificates, we're the fastest place to get an EV cert, we check as much as we can before you pay us a cent, and our application process is 80 seconds.

You might want to fix your webdesign: http://i.imgur.com/zQbWnUI.png And this is in Firefox, which renders fonts more bold than other browsers.

Edit:

I've made some changes to Typekit to thicken things up. Is it better? If not, can you provide details of your OS?

Original:

I'll investigate and fix that now. What OS are you on so I can reproduce it?

It looks this this here in Firefox (http://imgur.com/WRWYzBx) and this in Chrome (http://imgur.com/6dFeQhG) on OS X, testing across multiple Macs here. I'd really like to fix it though! Thanks for the heads up!

We moved from Google Fonts to TypeKit recently, so I suspect it may have happened then.

Re: Our First Certificate Is Now Live

#185

Post by bigiain »

cpach wrote: post #180
pakitan wrote: post #168

Earlier quoted context omitted.

A valid certificate only allows you to have a secure connection without errors and warnings popping up all over. It does nothing to guarantee that the domain is "legit". You can already set up thecitibank.com and get an SSL certificate for it without any problem. What you can't do is get the EV (green bar) certificate where indeed you need to go through a human. But I'm pretty sure Let's Encrypt won't be giving away…

”without any problem” Are you sure about that?

Yeah - there's many ssl vendors who've automated everything - so long as you can read email sent to webmaster@whatever-damned-phishing-domain-you-like.com, they'll sign a csr for that domain's ssl cert.

Re: Our First Certificate Is Now Live

#186

Post by bigiain »

vacri wrote: post #183
chetanahuja wrote: post #177

Earlier quoted context omitted.

"This comment is the exact perception about HTTPS that we need to change. It's not the job of HTTPS to say whether a website is safe or unsafe." Too late. The web industry has spent about 20 years training regular people to look for that green lock sign in the address bar and feel all warm and fuzzy about how safe the site is. You can post on hacker news all you want about what perceptions need to be changed. It's no…

Green lock = EV cert. People are trained to look for the green, not for the lock - few people other than techies even look for a grey lock. EV certs generally have much more stringent requirements than "hey, give me a cert!".

I'm pretty sure "People are trained to look for the green, not for the lock" is newer and not nearly as widely known advice as "look for the lock". And it's pretty obvious just looking around non-tech-related sites that even the "look for the lock" advice isn't all that well received - so many sites use images of padlocks on the page to imply "banking grade security!!!", surely not _all_ of them are incompetent - I have a strong suspicion that at least some of those people are doing it as part of high statistical significance validated A?B tested funnel optimisations...

Re: Our First Certificate Is Now Live

#187

Post by bigiain »

creshal wrote: post #178
simula67 wrote: post #164

Sorry for asking a potentially dumb question : but is it possible for me to set up a domain name thecitibank.com and ask letsencrypt to issue me a certificate ? I can then create a login page to steal IPINs. Isn't that why we have humans in the loop for issuing certificates ?

Yes, you can. You can also do the same at every existing CA that provides domain verified certificates. From personal experience neither StartSSL nor Comodo have a human in the look – until you want more than domain verification (e.g., "green bar" EV certificates).

StartSSL at least have a human in the loop for your initial identity validation. They got in touch with me because I'd put a work address in instead of my home address, and they worked it out and sent me a very human-like email asking me to correct it.

Re: Our First Certificate Is Now Live

#188

Post by weavie »

pakitan wrote: post #168
simula67 wrote: post #164

Sorry for asking a potentially dumb question : but is it possible for me to set up a domain name thecitibank.com and ask letsencrypt to issue me a certificate ? I can then create a login page to steal IPINs. Isn't that why we have humans in the loop for issuing certificates ?

A valid certificate only allows you to have a secure connection without errors and warnings popping up all over. It does nothing to guarantee that the domain is "legit". You can already set up thecitibank.com and get an SSL certificate for it without any problem. What you can't do is get the EV (green bar) certificate where indeed you need to go through a human. But I'm pretty sure Let's Encrypt won't be giving away…

Surely you would at least need access to a relevant email address on that domain? How would you bypass that?

Re: Our First Certificate Is Now Live

#189

Post by nailer »

LeoNatan25 wrote: post #134
nhebb wrote: post #123

Earlier quoted context omitted.

Just removing the font-weight: 300 helps tremendously. Personally, I'm becoming less of a fan of external fonts. I've noticed lately that they're often the slowest thing to load on sites that use them (especially Google fonts).

The weight works great on a high DPI display, but on older displays, it just doesn't work. Open on a rMBP or iPad, and it's beautiful. I'm guessing the designers are working on a high DPI Mac.

Edit: should be sorted.

Original: working on a standard DPI Mac, but it still looks fine - see http://imgur.com/WRWYzBx. Trying to figure it out now...

Re: Our First Certificate Is Now Live

#190

Post by cpach »

kolev wrote: post #150
twothamendment wrote: post #147

Earlier quoted context omitted.

Maybe so, but you know every regular guy driving a regular car would rather have a Ferrari and might even spend time looking at them even though he can't buy one.

You're wrong. EV is a scam. I can afford to buy EV for most of my sites, but I don't do it. Because consumers don't really care. Even HN doesn't have an EV! Ferrari is what everybody wants, EV is a different story! And stop downvoting all my comments - it shows your subpar human material. Downvote my main point and stop right there. No need to go aggressive and try to silence me and not comment further, because you w…

As per the guidelines, please keep discussions civil on HN and please don't complain about being downvoted.

https://news.ycombinator.com/newsguidelines.html

Post reply on HN