Seems Let's Encrypt also have control of https://letsdecrypt.org . It takes you to https://www.nsa.gov rather than Let's Encrypt. Not sure what to make of that!
Seems like a joke, including the fact it is only acceptable over HTTP.
10 Years of Let's Encrypt
351–360 of 361 posts
Re: 10 Years of Let's Encrypt
#352Earlier quoted context omitted.
I sign my zones :) The reliable way is DoH/DoT that are rapidly going to become the standard. They don't suffer from fragmentation issues, so they can reliably get the DNSSEC chain. Or maybe the next step is putting the stapled response into the certificate. Perhaps it can even be used by Let's Encrypt as a part of the challenge, providing the incentive to get it right. The original stapled DNSSEC experiment was suff…
Huh? What did CAs have to do with stapling?
Stapling needs to be an intermediary step, in parallel with existing trusted CAs. When stapling was tried first in Chrome, no CAs were interested in setting up something like Let's Encrypt, using DNSSEC to automatically issue certificates.
Re: 10 Years of Let's Encrypt
#353Let's Encrypt is awesome. Is there any other ridiculously overpriced good/service that could be Let's Encrypt'ed today?
Re: 10 Years of Let's Encrypt
#354Earlier quoted context omitted.
Huh? What did CAs have to do with stapling?
Stapling needs to be an intermediary step, in parallel with existing trusted CAs. When stapling was tried first in Chrome, no CAs were interested in setting up something like Let's Encrypt, using DNSSEC to automatically issue certificates.
No it doesn't? Why would it? I'm confused by what it is you think CAs have to do with DNSSEC stapling. CAs are absolutely not the reason DANE staples failed.
Re: 10 Years of Let's Encrypt
#355Earlier quoted context omitted.
In many countries, company names are unique to that country. And combined with country TLDs controlled by the nation-state itself, it'd be possible for at least barclays.co.uk to be provably owned by the UK bank itself when a EV cert is presented by the domain. In the US though, every state has it's own registry, and names overlap without the power of trademark protection applying to markets your company is not in.
That's not exactly a great example, is it? "Barclay" even has a disambiguation page on Wikipedia, because it's a reasonably common Scottish surname. For example, there used to be a Scottish company constructing steam locomotives which traded under the "Barclays & Co" name - because it was founded by one Andrew Barclay. There's also the Barclay Academy secondary school, and a Bentley dealer which until recently operat…
Barclays used to operate under Barclays Bank PLC. IMO, if disambiguation was problematic online they would have reverted back to that name.
You bring up good points, but I don't think that company naming has to be 100% proof against confusion, it's just one more helpful thing for consumers to identify whom they are doing business with.
In the case of close names like "Barkley", if they're doing banking, there is probably a trademark case against if they actually use it to confuse customers.
Intrestingly enough, "Barkley Holdings" was registered by competing bank HSBC: https://find-and-update.company-information.service.gov.uk/c...
Re: 10 Years of Let's Encrypt
#356Re: 10 Years of Let's Encrypt
#357Earlier quoted context omitted.
Stapling needs to be an intermediary step, in parallel with existing trusted CAs. When stapling was tried first in Chrome, no CAs were interested in setting up something like Let's Encrypt, using DNSSEC to automatically issue certificates.
No it doesn't? Why would it? I'm confused by what it is you think CAs have to do with DNSSEC stapling. CAs are absolutely not the reason DANE staples failed.
Staples failed because they couldn't work alone. They were considered a replacement for completely self-signed certificates.
That's why the committee tried to mandate the stillborn pinning idea.
The option to use stapling in addition to a CA-signed certificate was not really considered. After all, if you paid for a CA-signed cert then why would you bother with stapling?
Re: 10 Years of Let's Encrypt
#358Earlier quoted context omitted.
No it doesn't? Why would it? I'm confused by what it is you think CAs have to do with DNSSEC stapling. CAs are absolutely not the reason DANE staples failed.
Staples failed because they couldn't work alone. They were considered a replacement for completely self-signed certificates. That's why the committee tried to mandate the stillborn pinning idea. The option to use stapling in addition to a CA-signed certificate was not really considered. After all, if you paid for a CA-signed cert then why would you bother with stapling?
Whatever thing you're talking about, it does not appear to be DANE stapling.
Re: 10 Years of Let's Encrypt
#359Earlier quoted context omitted.
Staples failed because they couldn't work alone. They were considered a replacement for completely self-signed certificates. That's why the committee tried to mandate the stillborn pinning idea. The option to use stapling in addition to a CA-signed certificate was not really considered. After all, if you paid for a CA-signed cert then why would you bother with stapling?
Whatever thing you're talking about, it does not appear to be DANE stapling.
It does? The idea was to staple the DNSSEC chain to the TLS, so that clients wouldn't have needed to do the whole DNS pointer chasing themselves.
The problem is that the MITM-ing adversary can just strip the DNSSEC chain and then replace the certificate. Without having a DNSSEC-enabled resolver, the client can't detect that. So stapling doesn't provide any additional security over the self-signed certificates.
The only proposed fix was to pin the DNSSEC-enabled URLs, using TOFU (Trust On First Use). And nobody wanted that.
There was no real discussion about adding the stapling in _addition_ to CA-signed certificates. Because at that time there was no point in doing that, no CA wanted to provide free signing.
This is changed now. The self-signed certificates are no longer status quo.
Re: 10 Years of Let's Encrypt
#36010 years of solving a problem that didn't exist,
and creating a few dozen new ones in the process.
Not evening mentioning the massive security risk they pose; Well, I did now.