291–300 of 318 posts
While SSL with self-signed certs don't make MITM attacks much harder, they do prevent passive evesdropping. Yet the firefox UI seems to imply the contrary, by making it harder to use https-sites with self signed certs than unencrypted sites.
Earlier quoted context omitted.
Why this project: https://letsencrypt.org/ is so important. From the site: Let’s Encrypt is a new Certificate Authority: It’s free, automated, and open. Arriving Mid-2015
You can also get a certificate with as many as 100 domains in the SAN for free from https://buy.wosign.com/free/FreeSSL.html
Earlier quoted context omitted.
No, not in the slightest. The EFF is a non-profit organization that exists to lobby for policy change. No such organization is worthy of much in the way of trust -- especially for such a sensitive instrument.
To look at the history and charter of the EFF and say you don't trust them "in the slightest" is a bit ridiculous. It's hard to take that kind of remark seriously. Look at who's involved and what they've done, and dismiss that under the broad strokes of "no such organization is worthy of trust"? Nonsense.
What I want involved is an identity verification organization whose mission is clearly defined to be identity verification and management of a PKI trust.
Earlier quoted context omitted.
No, not in the slightest. The EFF is a non-profit organization that exists to lobby for policy change. No such organization is worthy of much in the way of trust -- especially for such a sensitive instrument.
What organization would you consider more trustworthy?
Earlier quoted context omitted.
It is waperware. Plus it requires you to run special software on your servers (not possible in a shared hosting environment).
> it requires you to run special software on your servers It doesn't, they ship a tool only for convenience. An open source tool running on your machine would be reverse-engineerable anyway. Plus, it is expected that shared hosting providers will run the tool for you.
Currently SSL is a revenue stream for many shared hosting providers. Are there are on-record comments from major providers who are planning on supporting Let's Encrypt?
Earlier quoted context omitted.
I don't agree. False pretense of security can be worse than visible insecurity.
> False pretense of security can be worse than visible insecurity. This applies to HTTP as well. That's why Firefox and Chrome will be visibly warning it's insecure.
I should be happy about this -- who wouldn't want the entire web to be encrypted -- but SSL is so broken for normal people. SSL is expensive (wildcard certificates run $70 a year and up), confusing (how does one pick between the 200 different companies selling certificates?), and incredibly difficult to set up (what order should I cat the certificate pieces in again?). If SSL doesn't change, this move will cut the li…
Mozilla pushing forward aggressively forces people to address the pain points.
Earlier quoted context omitted.
You don't have to run the Let's Encrypt client, but you do have to be able to do things to prove that you control the domain. Currently the Let's Encrypt client assumes that it's being run on the same machine on which domain control will be proved (though not necessarily the same machine where the cert will eventually be deployed). Someone could write another client application which gives instructions to complete th…
So you don't have to run the Let's Encrypt client? I was under the impression you did because without running the client there was no way to communicate with the Let's Encrypt service? Or do you mean, you can have multiple servers and only need to run the client on one of them?
It's also right that you can have multiple servers and only run the client on one of them, if you're willing to copy key material from one server to another.
Earlier quoted context omitted.
People always tout StartCom as a free provider (which is really great) but they forget to mention that it's only free for personal use. StartCom offers the free (for personal use) Class 1 X.509 SSL certificate "StartSSL Free" http://en.wikipedia.org/wiki/StartCom
Right, and for anything that is commercial, a <$10/yr SSL certificate shouldn't be a huge deal. It's not perfect, it should all be free, but saying cost is a barrier is BS, in my opinion.
Yes, even $50/year for a business in not that big a deal but so much of the market has international users where $50 is really expensive. There are also small time hobby/businesses where $50 makes an impact.
Earlier quoted context omitted.
So you don't have to run the Let's Encrypt client? I was under the impression you did because without running the client there was no way to communicate with the Let's Encrypt service? Or do you mean, you can have multiple servers and only need to run the client on one of them?
I mean that you need to run some client software, but it doesn't have to be the client software we're writing. Other people can implement ACME, for example in hosting provider infrastructure or in server software or other configurations. There could be an ACME client where the verification steps indicated to the user are performed manually rather than automatically. You could probably even speak ACME with curl, altho…