Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

10 Years of Let's Encrypt

letsencrypt.org

Post reply on HN
Print view View original

301–310 of 361 posts

Re: 10 Years of Let's Encrypt

#301

Post by DaSHacka »

rokkamokka wrote: post #9
jjice wrote: post #5

Let's Encrypt was _huge_ in making it's absurd to not have TLS and now we (I, at least) take it for granted because it's just the baseline for any website I build. Incredible, free service that helped make the web a more secure place. What a wonderful service - thank you to the entire team. The CEO at my last company (2022) refused to use Let's Encrypt because "it looked cheap to customers". That is absurd to me beca…

No! Let's encrypt is easily the best thing that's happened for a secure internet the last 10 years.

And equally as much for a centralized internet...

Re: 10 Years of Let's Encrypt

#302

Post by dns_snek »

mook wrote: post #91
Analemma_ wrote: post #19

Earlier quoted context omitted.

I've seen people complain that Let's Encrypt is so easy that it's enabling the forced phaseout of long-lived certificates and unencrypted HTTP. I sort of understand this, although it does feel like going "bcrypt is so easy to use it's enabling standards agencies to force me to use something newer than MD5". Like, yeah, once the secure way is sufficiently easy to use, we can then push everyone off the insecure way; th…

Yeah, I hate how it made housing things locally without a proper domain name very difficult. My router _shouldn't_ have a globally recognized certificate, because it's not on a publicly visible host. There's certainly advantages to easily available certificates, but that has enabled browsers and others to push too far; to be sure, though, that's not really a fault of Let's Encrypt, just the people who assume it's som…

> My router _shouldn't_ have a globally recognized certificate, because it's not on a publicly visible host.

If you're not encrypting local network traffic then any rogue device on that network can decide to intercept it and steal your admin password. That's one of the biggest reasons why we adopted HTTPS in the first place - whether a host is public or not isn't relevant.

It doesn't need a "globally" recognized certificate signed by a public CA, self-signed ones are fine. At home I manage mine with XCA. I have a root CA that's installed on all of my devices, with name constrains set to ".internal", ensuring it can't be used to sign certificates for any other domains.

Re: 10 Years of Let's Encrypt

#303

Post by dns_snek »

iso1631 wrote: post #284
crapple8430 wrote: post #158

Earlier quoted context omitted.

A related issue is that most consumer devices (both iPhone and current Android) make it impossible or extremely difficult to trust your own root CA for signing such certs.

I don't want to trust my own root CA as I don't trust myself to keep it secure. I want to important it only for a specific set of domains. "Allow this rootca to authenticate mydomain.com, addmanager.com, debuggingsite.com", which means even if compromised it won't be intercepting mybank.com

You can absolutely do that with name constraints extension set on the root CA certificate. You should verify compatibility but it's pretty universally supported on modern browsers and consumer devices last I checked.

    nameConstraints=critical,permitted;DNS:.iso1631.internal
- "critical" ensures that any clients who don't understand this extension fail the certificate validation outright instead of ignoring it.

- "DNS:.iso1631.internal" limits the scope to all subdomains of the given domain, e.g. "www.iso1631.internal"

https://datatracker.ietf.org/doc/html/rfc5280#section-4.2.1....

Re: 10 Years of Let's Encrypt

#304

Post by crote »

duskwuff wrote: post #225
crote wrote: post #171

Earlier quoted context omitted.

What's the alternative, showing the company's unique registration ID? CAs invented EVs because the wanted to sell something which could make them more money than DVs. The fact that company names aren't unique means that the whole concept was fundamentally flawed from the start: there is no identifier which is both human-readable and guaranteed to uniquely identify an entity. They wanted to sell something which can't…

The alternative would have been to have the CA use human judgement when approving EV certificates and reject applications from organizations whose names shadowed better-known firms, or to only accept applications from a select set of organizations (like, say, banks). But either of those possibilities would have increased the cost of the program and limited the pool of applicants, so CAs chose the cheap, easy path whi…

How do you decide when a company is "well-known"? What's going to happen when there are two well-known companies with the same name or a very similar name? What if a well-known company in country A expands to country B, where a well-known company with that name (but active in a different industry) already exists? How are you going to deal with subsidiaries which are both legally and organizationally separate? Who gets to keep the EV when a company spins off a division but both parts retain the same name?

"Use human judgement" might work for trivial examples of fraud, but it quickly breaks down once you try applying it to the real world. Besides, how are you going to apply the same "human judgement" across hundreds of employees at dozens of CAs? If anything, you're just begging to get sued by large corporations whose complex situation fell on the wrong side of your human judgement.

Re: 10 Years of Let's Encrypt

#305

Post by DaSHacka »

iso1631 wrote: post #286
KronisLV wrote: post #276

Cloudflare: "Oh no, we can't have that much centralization, that's horrible, just think of the impact outages have!" Let's Encrypt: crickets Obviously I use LE myself and like what they do, and even in the example above some downtime would have less of an impact than Cloudflare would (due to renewals being less time sensitive), I'm just surprised that there aren't like 5 other orgs that do the same at scale, like an…

If LE goes down for a week you can't deploy new certs, but your existing ones will work, as you renew them a few weeks before expiry anyway That also gives you enough time to change to get your certs from elsewhere As you mention zerossl exista, and I think google GCM will give you free certs too. Globalsign has an ACME interface for paying customers, although I'm told it has issues (you have to rotate keys manually…

> If LE goes down for a week you can't deploy new certs, but your existing ones will work, as you renew them a few weeks before expiry anyway

Assuming certificate expiration times remain over 7 days per certificate.

Re: 10 Years of Let's Encrypt

#306

Post by RandyOrion »

8cvor6j844qw_d6 wrote: post #236
RandyOrion wrote: post #233

Thank you Let's Encrypt, together with the acme.sh , caddy and the whole ecosystem for TLS. You simply cannot emphasize the information security enough if all your Internet traffic is audited, censored and manipulated by a number of adversaries supported by (authoritarian) governments and what not.

Caddy's way of using plugins seems to require building custom binaries, may I know if that's what you did? I preferred to use wildcard certs, which requires a plugin for the dns

Well, I use Arch Linux and the caddy package from pacman just works. You may checkout https://github.com/caddyserver/xcaddy for custom caddy build.

Besides, I don't use wildcard certs. I use caddy to reverse proxy a number of self-hosting things, and manually assign domain names to each of them. Caddy can handles many certs just fine.

Re: 10 Years of Let's Encrypt

#307

Post by hgs3 »

Congratulations to Let’s Encrypt. I do wish there was something akin to them for code signing. OV and EV certificates are out of reach for many indie devs.

Re: 10 Years of Let's Encrypt

#308

Post by crote »

dismantlethesun wrote: post #196
crote wrote: post #159

Earlier quoted context omitted.

The problem is that people wrongly believe that company names are unique. In reality you're just some paperwork and a token registration fee away from a name clash. If anything, it's a disadvantage . People are going to be less cautious about things like the website's domain name if they see a familiar-sounding company name in that green bar. "stripe-payment.com" instead of "stripe.com"? Well, the EV says "Stripe, In…

In many countries, company names are unique to that country. And combined with country TLDs controlled by the nation-state itself, it'd be possible for at least barclays.co.uk to be provably owned by the UK bank itself when a EV cert is presented by the domain. In the US though, every state has it's own registry, and names overlap without the power of trademark protection applying to markets your company is not in.

That's not exactly a great example, is it? "Barclay" even has a disambiguation page on Wikipedia, because it's a reasonably common Scottish surname.

For example, there used to be a Scottish company constructing steam locomotives which traded under the "Barclays & Co" name - because it was founded by one Andrew Barclay. There's also the Barclay Academy secondary school, and a Bentley dealer which until recently operated as Jack Barclay Ltd.

And that's just the UK ones! Barclays operates internationally, which means they want "barclays.com", so suddenly there's also Barclay-the-record-label, Barclay-the-cigarette-brand, Barclay-the-liquor-brand, Barclay College, golf tournament The Barclays, Barclays Center (whose naming rights were bought by the bank, but they of course want their own completely distinct website), Barclay Theatre, three Barclay Hotels.

Of course there's also all the stuff under "Barkley", "Barkly", "Berkley", and probably a dozen other variations just waiting to be used to scam dyslexic Barclays custumers.

Re: 10 Years of Let's Encrypt

#309

Post by chuckreynolds »

Seems longer than 10 years ago? But hey... Let's Encrypt absolutely changed the game... TLS and certificates were a huuuuuge PITA and expensive... we only used them when money was moving around online and they were slow most times. It was also a process to add one, update one, etc. I remember not trusting it at first because it was so easy lol. THANK YOU Let's Encrypt... you made us all more sane, saved time, and secured us all up too. Firm handshakes.

Re: 10 Years of Let's Encrypt

#310

Post by crote »

btown wrote: post #217
tadfisher wrote: post #84

Earlier quoted context omitted.

Problem is, I can easily set up a company and get an EV cert for "FooBar Technologies, LLC" and phish customers looking for "FooBar Incorporated" or "International FooBar Corp.". Approximately zero users know the actual entity name of the real FooBar.

BIMI, as misguided as it is, does aim to solve this by tying registration to insanely high prices and government-registered trademark verification. You would have a hard time registering the Stripe trademark nowadays in a way that would get you a BIMI certificate for that name/logo. https://www.thesslstore.com/resources/bimi-certificate-cost-... But I'm glad that it hasn't caught on as strongly-expected by the public…

Trademarks are industry-specific. Ordinarily, a painting company called Stripe isn't going to cause confusion with the payment platform Stripe, so there's no reason to deny the trademark.

It's how you end up with both Apple Corps (the Beatles' record label) and Apple Computer (the tech company). They've been involved in quite a few lawsuits over the years, mostly because the tech company decided to expand into the multimedia business.

Post reply on HN