321–330 of 375 posts
Earlier quoted context omitted.
Not just intercept: Using HTTPS prevents messing with the connection in-flight. So an attacker won't be able to inject their own payload into that web page you just requested.
Except you’re using garbage certificates so anyone could MITM you and inject whatever they like.
Earlier quoted context omitted.
Can you describe the kind of person who hosts their own website but cannot easily set up Let's Encrypt automatic renewal?
Me. I use shared hosting on a server that runs a reverse nginx proxy to my nginx server. I don't have root on the server. I have a LE cert that I need to manually fiddle with DNS settings every 3 months to get. If you know how to automate it I'd love to hear about it.
If you can't use HTTP-01 and must use DNS-01 challenge, I would check whether the software that runs your host's DNS management panel has an API in addition to manual mode. If not, I would check for ability to automate HTTP requests to that tool (parse the HTML, submit the forms, basically). My hope would be that the tool is popular and someone already did the work and code exists to operate it as if it had an API.
If you can do that, you can write (or find one already written) a certbot plugin that performs the DNS challenge using your credentials to the host provided DNS settings. certbot has number of plugins for the big hosting providers: https://github.com/certbot/certbot
certbot is the most popular Let's Encrypt client, but it's not the only one. Maybe another client has support for your situation. I would maybe ask the support of your hosting provider, maybe they know something.
Isn't this going from real security measures towards security theater?
This is a security theater and I think it's intended to make TLS maintenance unbearable for non-IT businesses and to push them to cloud hosting providers like Google Cloud and Cloudflare.
Also latest drafts of TLS ESNI/ECH feature were written by Cloudflare for Cloudflare's needs.
Earlier quoted context omitted.
It’s a glaring security hole, IMHO. I create such devices and the only way I know is self-signed certs, but the browsers complain a lot about that. Ideally there’d be a way to sign .local domains with browsers handling it while letting people know to verify the identity of their local devices/services and that the identity isn’t verified by https like most sites. The issue lies between the browsers and https system.…
Crazy idea: Why not serve an initial page over HTTP, and then implement encryption in JS using webcrypto for all subsequent calls. I'm not sure self-signed HTTPS can do much better than this anyways. (Yes, yes, it's a crazy idea, hehe)
Self signed HTTPS works for this case as long as you know the fingerprint/cert to accept.
Earlier quoted context omitted.
How is it not practical? It's really not hard to set up and there is great documentation out there
I get the feeling you have no real experience either running a company network or dealing with end users and home networks. Any of these solutions work fine for a majority of people who just use their laptop in Starbucks, but they really break down when you need to start doing anything more complicated than that.
Remember the good old time when it was not an almighty cartel of browsers that controlled your internet? This is so an arbitrary decision and so much a pain in the ass. Again, a limited number of people used their corporate interests to decide for the whole world with almost no discussion. The worst is that the "security" argument for this change is quite weak. Yes, we can think that shorter certificates are a little…
“Yes, we can think that shorter certificates are a little bit better to trust for the user, but that should be the choice of the website that you visit.” I would think the choice on how long to trust a certificate should be on the user, possibly using the hint that the creator of the certificate gave. You wouldn’t trust a certificate from evil-empire.com , no matter its expiration date, would you? The discussion shou…
So in the end, websites determine their 'trust value' without the browsers 'police', that will let the possibility for special cases.
For example, if I do a device that is to be used out of internet for 3 years, logically the user will not see an issue with a 5 years certificate.
Internet starts to have 1y memory retention. Unless refreshed by active learning, aka someone doing the refresh job. Or unless delegating the work to large players—either the memory or the hosting. EDIT: This feels wrong, even when done for right reasons. And I wonder whether this would fly without LE and whether this means we are officially making LE THE critical part of Internet infrastructure.
Internet starts to have 1y memory retention. Unless refreshed by active learning, aka someone doing the refresh job. Or unless delegating the work to large players—either the memory or the hosting. EDIT: This feels wrong, even when done for right reasons. And I wonder whether this would fly without LE and whether this means we are officially making LE THE critical part of Internet infrastructure.
On the contrary… LE is unaffected by this, since from the beginning it has enforced a much shorter certificate expiry time: 90 days. Which effectively forces you to set up automated renewals. Doing that does not require the help of "large players"; you stick certbot or another tool in your crontab, or use something like Caddy or Apache mod_md to have your web server do it by itself.
This approach is more reliable than cron in case of failures/errors. Not only are there fewer moving parts, Caddy's error handling logic and retries are smarter than just "try again in ".
Earlier quoted context omitted.
What are some valid reasons not to use LetsEncrypt?
It’s extremely insecure if you’re worried about things beyond passive mass surveillance. If someone can intercept traffic to your server IP, they can get a Let’s Encrypt certificate. If they can’t reliably man in the middle that IP, then HTTP is reasonably secure already. Such “certificates without certification” This is one reason browsers have added new UI elements for certified domains.
Earlier quoted context omitted.
or you could follow established best practices and secure your site with TLS.
Both. I am not responsible if you chose a shitty ISP.
If we could trust the entire network we wouldn’t need TLS for any site.