Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

10 Years of Let's Encrypt

letsencrypt.org

Post reply on HN
Print view View original

191–200 of 361 posts

Re: 10 Years of Let's Encrypt

#191

Post by wnevets »

BHSPitMonkey wrote: post #166
wnevets wrote: post #142

Earlier quoted context omitted.

The replies to my original comment make it obvious who has gotten an EV cert from a quality CA before and who hasn't.

This exchange seemingly proves the argument that user trust gained from the EV treatment is misplaced, and that the endeavor was a farce all along. It's not as though the user's browser was distinguishing the good CAs from the bad!

I disagree. I specifically said in my original comment they were very useful for those that knew what EV certs were and EV certs weren't.

You may not know that Digicert is a quality CA who wasn't going to risk their position as a CA to sign an EV cert for a typo squatting phishing site pretending to be PayPal but there are those who do. The green UI in chrome & firefox made finding all of this information out incredibly simple and obvious.

Re: 10 Years of Let's Encrypt

#192

Post by Ayesh »

asim wrote: post #36

As a sysadmin in the 2007-2011 timeframe I literally used openssl to generate csrs, went to godaddy to purchase SSL certificates and then manually deployed them to servers. Man what a world of change. Let's encrypt is one the best services we've had on the internet. I wish we had more things like this.

It's been a long time so this is my fading memory, but CAs used to generate a private key on their end and let you download both private key and the certificate containing the public key. The non-technical person who paid big money for the certificate then emails the zip file to the developer. That's when StartTLS wasn't that big back then either.

Just comically bad way to obtain certs.

Re: 10 Years of Let's Encrypt

#193

Post by invokestatic »

bangaladore wrote: post #81
Uvix wrote: post #64

Earlier quoted context omitted.

Depends on the registrar. Globalsign required the phone number to be one publicly listed for the company in some business registry (I forget exactly which one), so it had to be someone in our main corporate office who'd deal with them on the phone.

For an online business in a dubious (but legal) domain, my co-owner spent a few hundred bucks registering a business in New Mexico with a registered agent to get an EV cert. So, a barrier to entry, but not much of one.

I have an almost identical story except the state in question was Nevada. I’m curious what “dubious” domain it was, for me it was video game cheats. Maybe I’m actually the co-owner you’re talking about. :)

Re: 10 Years of Let's Encrypt

#194

Post by Ayesh »

t1234s wrote: post #87

Lets hope they stay independent and never get acquired by Google or any other large tech company. You can imagine a web where SSL issuance is used as a tool to censor websites. I think most browsers have been made to make standard http sites look malicious to normal users.

As someone else mentioned, it's a non-profit, so I guess it's not technically possible to get acquired.

But I personally believe that the people behind LetsEncrypt genuinely care about the mission and will never sell out for their personal benefit.

If there was a list of organizations that bring the most impactful things to tech per each dollar received in donations and per each employee, ISRG will be up there at the top.

Re: 10 Years of Let's Encrypt

#195

Post by tptacek »

cyberax wrote: post #187

The next steps: 1. Add support for DNS-based persistent authentication: https://datatracker.ietf.org/doc/draft-ietf-acme-dns-persist... 2. Allow the user to just publish their public key into that TXT record. 3. Cut out the middleman and do the authentication directly in the browser. 4. DANE

DANE isn't going to happen, and if you want to tilt at that windmill, it's Chrome and Mozilla you need to pressure, not LetsEncrypt.

Re: 10 Years of Let's Encrypt

#196

Post by dismantlethesun »

crote wrote: post #159
realityking wrote: post #89

Earlier quoted context omitted.

EV certs also showed the legal name of the company that requested the certificate - that was an advantage.

The problem is that people wrongly believe that company names are unique. In reality you're just some paperwork and a token registration fee away from a name clash. If anything, it's a disadvantage . People are going to be less cautious about things like the website's domain name if they see a familiar-sounding company name in that green bar. "stripe-payment.com" instead of "stripe.com"? Well, the EV says "Stripe, In…

In many countries, company names are unique to that country. And combined with country TLDs controlled by the nation-state itself, it'd be possible for at least barclays.co.uk to be provably owned by the UK bank itself when a EV cert is presented by the domain.

In the US though, every state has it's own registry, and names overlap without the power of trademark protection applying to markets your company is not in.

Re: 10 Years of Let's Encrypt

#197

Post by davidkwast »

cortesoft wrote: post #144
rplnt wrote: post #139

Earlier quoted context omitted.

Random anecdote: I have a device in which the http client can't handle https. Runs out of memory and crashes. Wasn't able to find a free host with a public http to host a proxy.

What is the device, if I may ask?

This can happen too with Micropython on Esp8266

Re: 10 Years of Let's Encrypt

#198

Post by Ayesh »

nodesocket wrote: post #186

Would be interesting to hear what database they are using and how they are doing replication? Is it simple master / slave or multi-master?

https://github.com/letsencrypt/boulder

You can find a docker-compose.yml file to get some idea.

Appears to be using MariaDB.

They shut down OCSP responders and expiry email reminders, so there really is no need to have a database apart from rate limits, auth data, and caching.

For Certificate Transparency, they are submitted to Google and CloudFlare run trees but I don't think LetsEncrypt run their own logs.

Re: 10 Years of Let's Encrypt

#199

Post by nodesocket »

Ayesh wrote: post #198
nodesocket wrote: post #186

Would be interesting to hear what database they are using and how they are doing replication? Is it simple master / slave or multi-master?

https://github.com/letsencrypt/boulder You can find a docker-compose.yml file to get some idea. Appears to be using MariaDB. They shut down OCSP responders and expiry email reminders, so there really is no need to have a database apart from rate limits, auth data, and caching. For Certificate Transparency, they are submitted to Google and CloudFlare run trees but I don't think LetsEncrypt run their own logs.

I assume they want to store metadata instead of having to pull from the certificates itself, but maybe that’s actually easier and more performant.

Re: 10 Years of Let's Encrypt

#200

Post by charcircuit »

tialaramex wrote: post #175
charcircuit wrote: post #162

Earlier quoted context omitted.

Most social media are free and easy to sign up for taking under a minute to do and have user bases that can be measured in the billions. Most people in the world are willing to follow the rules. Most people don't use social media via the web. They use it via dedicated apps. I think it's natural that people who don't want to deal with the tech side of things will outsource it to someone else. The idea that everyone wi…

For now, in some jurisdictions, social media is "free" for your customers in the sense that it's supported by advertising. It's not free for you of course because advertising isn't free and from their point of view what you'd be getting is free advertising so they want you to pay them to put it in front of your customers.

You don't have to advertise to have your company's posts gain traction on social media.
Post reply on HN