Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

10 Years of Let's Encrypt

letsencrypt.org

Post reply on HN
Print view View original

231–240 of 361 posts

Re: 10 Years of Let's Encrypt

#231

Post by tptacek »

ekr____ wrote: post #226
cyberax wrote: post #204

Earlier quoted context omitted.

I mean, these are the steps that can bring it. And with Let's Encrypt as a safe fallback, it actually is feasible this time. Long shot? Yes. But not impossible.

What's the incentive for individual sites or browsers to do this? From the site's perspective, they're going to need to have a WebPKI certificate for the foreseeable future, basically until there is no appreciable population of WebPKI-only clients, which is years in the future. So DANE is strictly more work. From the browser's perspective, very few sites actually support DANE, and the current situation is satisfactor…

A fun note: I vibecoded a dumb thingy that monitors the top 1000 zones on the Tranco research list of popular zones for DNSSEC status:

https://dnssecmenot.fly.dev/

Obviously, the headline is that just 2% of the top 100 zones are signed (thanks to Cloudflare). But the funnier thing is: in 5+ months of letting this thing run, it's picked up just three changes to DNSSEC status among all the zones it monitors. The third happened just an hour or so ago, when Canva disabled DNSSEC.

Re: 10 Years of Let's Encrypt

#232

Post by kbolino »

anonymars wrote: post #229
kbolino wrote: post #208

Earlier quoted context omitted.

Absent widespread adoption of DNSSEC, which has just not happened at all , I don't see any alternative. The authentication must be done before the encryption parameters are negotiated, in order to protect against man-in-the-middle attacks. There must be some continuity between the two as well, since the authenticated party (both parties can be authenticated, but only one has to be) must digitally sign its parameters.…

This applies to grandparent too (for the record I largely agree with them) but the issue isn't just "authenticity" but "identification" -- there's no real attestation about who is in on the other end of the site. This identity was once at least somewhat part of the certificate itself.

Yes, it is fair to say that domain names are not the sum total of identity. However, the EV certificate experience showed that, at least in terms of WebPKI and the open Internet, there really isn't anything better than domains yet.

We have clear and seemingly easy go-to examples like proving that yes, this is THE Microsoft, and not a shady fly-by-night spoof in a non-extradition territory, but apart from the headline companies--who as of late seem to like changing their names anyway--this actually isn't easy at all.

Walled gardens like app stores have different trade-offs, admittedly.

Re: 10 Years of Let's Encrypt

#233

Post by RandyOrion »

Thank you Let's Encrypt, together with the acme.sh , caddy and the whole ecosystem for TLS.

You simply cannot emphasize the information security enough if all your Internet traffic is audited, censored and manipulated by a number of adversaries supported by (authoritarian) governments and what not.

Re: 10 Years of Let's Encrypt

#234

Post by j16sdiz »

Ayesh wrote: post #192
asim wrote: post #36

As a sysadmin in the 2007-2011 timeframe I literally used openssl to generate csrs, went to godaddy to purchase SSL certificates and then manually deployed them to servers. Man what a world of change. Let's encrypt is one the best services we've had on the internet. I wish we had more things like this.

It's been a long time so this is my fading memory, but CAs used to generate a private key on their end and let you download both private key and the certificate containing the public key. The non-technical person who paid big money for the certificate then emails the zip file to the developer. That's when StartTLS wasn't that big back then either. Just comically bad way to obtain certs.

Many CA have in browser javascript-based private key generation.

(Of course the same page have GoogleAnalytics and facebook button -- otherwise it would be too secure.)

Re: 10 Years of Let's Encrypt

#235

Post by bruce511 »

charlesbarbier wrote: post #80
btown wrote: post #24

Earlier quoted context omitted.

To be fair, for a CEO in 2022, EV certificates had only lost their special visualizations since September/October 2019 with Chrome 77 and Firefox 70 - and with all that would happen in the following months, one could be forgiven for not adapting to new browser best practices! https://www.troyhunt.com/extended-validation-certificates-ar...

It was a red herring the entire time. At Shopify we made experiment regarding conversion between regular certs and EV before they stop being displayed and there was no significant difference. The users don't notice the absence of the fancier green lock.

I think the rebuttal to the CEO today is really very simple.

a) How many of the sites you visit everyday have DV and how many have EV certificates?

b) Name any site at all, that you have visited, where your behavior or opinion has changed because of the certificate?

In truth the green-bar thing disappeared on mobile long before desktop (and in some cases it was never present.)

In truth if you polled all the company staff, or crumbs just the people round the boardroom table (probably including the person complaining) a rounding error from 0 could show you how to even determine if a cert was DV or EV.

EV could have an inspector literally visit your place of business, and it would still have no value because EVs are invisible to site visitors.

Re: 10 Years of Let's Encrypt

#236

Post by 8cvor6j844qw_d6 »

RandyOrion wrote: post #233

Thank you Let's Encrypt, together with the acme.sh , caddy and the whole ecosystem for TLS. You simply cannot emphasize the information security enough if all your Internet traffic is audited, censored and manipulated by a number of adversaries supported by (authoritarian) governments and what not.

Caddy's way of using plugins seems to require building custom binaries, may I know if that's what you did?

I preferred to use wildcard certs, which requires a plugin for the dns

Re: 10 Years of Let's Encrypt

#237

Post by ingenium »

crapple8430 wrote: post #158
mook wrote: post #91

Earlier quoted context omitted.

Yeah, I hate how it made housing things locally without a proper domain name very difficult. My router _shouldn't_ have a globally recognized certificate, because it's not on a publicly visible host. There's certainly advantages to easily available certificates, but that has enabled browsers and others to push too far; to be sure, though, that's not really a fault of Let's Encrypt, just the people who assume it's som…

A related issue is that most consumer devices (both iPhone and current Android) make it impossible or extremely difficult to trust your own root CA for signing such certs.

Android is pretty easy, you just add it to the keystore and that's it. I've had my own CA long before Let's Encrypt, but now mostly only use it for non-public devices that can't easily use Let's Encrypt (printers, switches, etc).

Re: 10 Years of Let's Encrypt

#238

Post by bruce511 »

cortesoft wrote: post #152
pedrozieg wrote: post #127

It’s easy to forget how awful TLS was before Let’s Encrypt: you’d pay per-hostname, file tickets, manually validate domains, and then babysit a 1-year cert renewal calendar. Today it’s basically “install an ACME client once and forget it” and the web quietly shifted from The impressive bit isn’t just the crypto, it’s that they attacked the operational problem: automation (ACME), good client ecosystem, and a nonprofit…

Just a few months ago my company was going through some transitions and wanted to get some certs to cover us while we migrated to a different stack with let's encrypt and automated cert renewals. We had some legacy systems on our network that needed certs and had various subdomains that prevented us from just having a wildcard cert. It ended up that we needed a few dozen subdomains with wildcard certs for each, and i…

I think the best analogy for this are scams. Once a scammer finds a mark they'll pay, there's a desire to soak them for as much as they'll bear.

EVs are not a scam per-se, but they also don't add any value. 80% of the world already figured that out, do by definition if you are asking you are in the bottom 20%.

Now I get you were in the process of migration, but that's an edge case. In a normal case if you go around asking to buy a wildcard EV, you basically have a sign saying "fleece me".

So yeah, there's still a market for people wanting to throw money at CAs, even in these comments you'll see some. And management types are especially prone to "sounds expensive, must be good" logic when spending other people's money.

Re: 10 Years of Let's Encrypt

#239

Post by tempaccountabcd »

callumgare wrote: post #137
Decoy1008 wrote: post #31

I am so grateful for this. Bummer that they stopped with the email reminder, anyways I was wondering how this would work without active payments. Still amazing.

Out of interest why do you care? I assume you’re using acme to automate renewals. Is it in case that fails? Or do you work with some system that can’t be automated?

[dead]
Post reply on HN