Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Acme, a brief history of one of the protocols which has changed the Internet

blog.brocas.org

Post reply on HN
Print view View original

41–50 of 91 posts

Re: Acme, a brief history of one of the protocols which has changed the Internet

#41

Post by inejge »

kragen wrote: post #22
stavros wrote: post #8

Let's Encrypt did more for privacy than any other organization. Before Let's Encrypt, we'd usually deploy TLS certificates, but as somewhat of an afterthought, and leaving HTTP accessible. They were a pain to (very manually) rotate once a year, too. It's hard to overstate just how much LE changed things. They made TLS the default, so much that you didn't have to keep unencrypted HTTP around any more. Kudos.

I think it was Snowden who made TLS the default. Let's Encrypt did great work, but basically having the NSA's spying made common knowledge (including revealing some things that were worse than we expected, like stealing the traffic between Google's data centers) created a consensus that unencrypted HTTP had to go, despite the objections of people like Roy Fielding.

> I think it was Snowden who made TLS the default.

Snowden's revelations were a convincing argument, but I would place more weight on Google in its "we are become Evil" phase (realistically, ever since they attained escape velocity to megacorphood and search monopoly status), who strove to amass all that juicy user data and not let the ISPs or whoever else have a peek, retaining exclusivity. A competition-thwarting move with nice side benefits, that is. That's not to say that ISPs would've known to use that data effectively, but somebody might, and why not eliminate a potential threat systemically if possible?

Re: Acme, a brief history of one of the protocols which has changed the Internet

#42

Post by figmert »

abhashanand1501 wrote: post #25

Can someone explain why letsencrypt certificates have to be 90 days expiry? I know there is automation available, but what is the rationale for 90 days?

Others have already given your answer, but heads up, LE is lowering the certificate lifetime to 45 days[0].

- [0] https://letsencrypt.org/2025/12/02/from-90-to-45

Re: Acme, a brief history of one of the protocols which has changed the Internet

#44

Post by globular-toast »

Lammy wrote: post #28
kragen wrote: post #22

Earlier quoted context omitted.

I think it was Snowden who made TLS the default. Let's Encrypt did great work, but basically having the NSA's spying made common knowledge (including revealing some things that were worse than we expected, like stealing the traffic between Google's data centers) created a consensus that unencrypted HTTP had to go, despite the objections of people like Roy Fielding.

Ironically, the inability to cache TLS on the edge of my network makes the Internet more surveillable since everything has to pass through the Room 641As of the world and subjects us all to more network behavior analysis. The TLS-everything world leaks so much more metadata. It's more secure but less private .

You can do it if you're happy to deploy your CA to your network, can't you? Deploying CA certs sucks, though. I wish it was easier.

Re: Acme, a brief history of one of the protocols which has changed the Internet

#45

Post by tialaramex »

trvz wrote: post #39
kragen wrote: post #22

Earlier quoted context omitted.

I think it was Snowden who made TLS the default. Let's Encrypt did great work, but basically having the NSA's spying made common knowledge (including revealing some things that were worse than we expected, like stealing the traffic between Google's data centers) created a consensus that unencrypted HTTP had to go, despite the objections of people like Roy Fielding.

The article claims http was kept around. My experience was, that once you setup https you just redirected http, like today. Snowden may have been a coincidence, too. We knew encryption was better, it was just too much of a hassle for most sites.

Redirection doesn't get the job done, without at least a mechanism so that browsers reliably stop visiting the HTTP site (HSTS) and ideally an HTTPS-everywhere feature which, in turn, was not deployable for ordinary people until almost every common site they visit is HTTPS enabled and works properly.

The problem is that there are active bad guys. Redirection means when there are no bad guys or only passive bad guys, the traffic is encrypted, but bad guys just ensure the redirect sends people to their site instead.

Users who go to http://mysite.example/ would be "redirected" to https://mysite.example/ but that redirection wasn't protected so instead the active bad guy ensures they're redirected to https://scam.example/mysite/ and look, it has the padlock symbol and it says mysite in the bar, what more do you want?

Snowden was definitely a coincidence in the sense that this wasn't a pull decision. Users didn't demand this as a result of Snowden. However, Snowden is why BCP #188 (RFC 7258) aka "Pervasive Monitoring is an Attack" happened, and certainly BCP #188 helped because it was shorthand for why the arguments against encryption everywhere were bogus. One or another advocate for some group who supposedly "need" to be able to snoop on you stands up, gives a twenty minute presentation about why although they think encryption is great, they do need to er, not have encryption, the response in one sentence is "BCP 188 says don't do this". Case closed, go away.

There are always people who insist they have a legitimate need to snoop. Right now in Europe they're pulling on people's "protect the children" heart strings, but we already know - also in Europe that the very moment they get a tiny crack for this narrative in march giant corporations who demand they must snoop to ensure they get their money, and government espionage need to snoop on everybody to ensure they don't get out of line.

Re: Acme, a brief history of one of the protocols which has changed the Internet

#46

Post by tialaramex »

throw0101a wrote: post #19

There are several other certificate provisioning protocols: * https://en.wikipedia.org/wiki/Simple_Certificate_Enrollment_...

So, the crucial thing ACME has that the other protocols do not is a hole (and some example ways to fill that hole for your purpose, though others are documented in newer RFCs) for the Proof of Control.

See, SCEP assumes that Bob trusts Alice to make certificates. Alice uses the SCEP server provided by Bob, but she can make any certificate that Bob allows. If she wants to make a certificate claiming she's the US Department of Education, or Hacker News, or Tesco supermarkets, she can do that. For your private Intranet that's probably fine, Alice is head of Cyber Security, she issues certificate according to local rules, OK.

But for the public web we have rules about who we should issue certificates to, and these ultimately boil down to we want to issue certificates only to the people who actually control the name they're getting a certificate for. Historically this had once been extremely hard core (in the mid-1990s when SSL was new) but a race to the bottom ensued and it had become basically "Do you have working email for that domain?" and sometimes not even that.

So in parallel with Let's Encrypt, work happened to drag all the trusted certificate issuers to new rules called the "Ten Blessed Methods" which listed (initially ten) ways you could be sure that this subscriber is allowed a certificate for news.ycombinator.com and so if you want to do so you're allowed to issue that certificate.

Several ACME kinds of Proof of Control are actually directly reflected in the Ten Blessed Methods, and gradually the manual options have been deprecated and more stuff moves to ACME.

e.g. "3.2.2.4.19 Agreed‑Upon Change to Website ‑ ACME" is a specific method which is how your cheesiest "Let's Encrypt in a box" type software tends to work, where we prove we control www.some.example by literally just changing a page on www.some.example in a specific way when requested and that's part of the ACME specification so it can be done automatically without a human in the loop.

Re: Acme, a brief history of one of the protocols which has changed the Internet

#47

Post by jstanley »

tialaramex wrote: post #45
trvz wrote: post #39

Earlier quoted context omitted.

The article claims http was kept around. My experience was, that once you setup https you just redirected http, like today. Snowden may have been a coincidence, too. We knew encryption was better, it was just too much of a hassle for most sites.

Redirection doesn't get the job done, without at least a mechanism so that browsers reliably stop visiting the HTTP site (HSTS) and ideally an HTTPS-everywhere feature which, in turn, was not deployable for ordinary people until almost every common site they visit is HTTPS enabled and works properly. The problem is that there are active bad guys. Redirection means when there are no bad guys or only passive bad guys,…

> Users who go to http://mysite.example/ would be "redirected" to https://mysite.example/ but that redirection wasn't protected so instead the active bad guy ensures they're redirected to https://scam.example/mysite/ and look, it has the padlock symbol and it says mysite in the bar, what more do you want?

You can do better than this. You can have your mitm proxy follow the SSL redirect itself, but still present plain HTTP to the client. So the client still sees the true "mysite.example" domain in the URL bar (albeit on plain http), and the server has a good SSL session, but the attacker gets to see all of the traffic.

Re: Acme, a brief history of one of the protocols which has changed the Internet

#48

Post by GJim »

tiagod wrote: post #9
gerdesj wrote: post #6

I remember deploying SSL on NetWare in the late 1990s and being given ... something that the US allowed to be exported as a munition! I don't recall the exact details but it was basically buggered - short key length. Long enough to challenge a 80386 Beowulf cluster but no match for whatever was humming away in a very well funded machine room. You could still play with all the other exciting dials and knobs, SANs and…

A few years ago a client of mine gave me a big-ish APC UPS. I recently got new batteries for it after the outage here in Portugal, and to turn on SSH I had to agree that I was not a terrorist organisation's nor in a country where encryption can not be exported to.

> I had to agree that I was not a terrorist organisation's nor in a country where encryption can not be exported to.

Don't forget when flying to the USA, ticking the box to say you won't try to overthrow the government.

I'm sure that clause has stopped many an invading army in their tracks.

Re: Acme, a brief history of one of the protocols which has changed the Internet

#49

Post by rusk »

inejge wrote: post #41
kragen wrote: post #22

Earlier quoted context omitted.

I think it was Snowden who made TLS the default. Let's Encrypt did great work, but basically having the NSA's spying made common knowledge (including revealing some things that were worse than we expected, like stealing the traffic between Google's data centers) created a consensus that unencrypted HTTP had to go, despite the objections of people like Roy Fielding.

> I think it was Snowden who made TLS the default. Snowden's revelations were a convincing argument, but I would place more weight on Google in its "we are become Evil" phase (realistically, ever since they attained escape velocity to megacorphood and search monopoly status), who strove to amass all that juicy user data and not let the ISPs or whoever else have a peek, retaining exclusivity. A competition-thwarting m…

Reading this it seems to me that ISPs missed a trick by not offering privacy features. These features were already baked into mobile wireless it probably wouldn’t have been a huge big deal for them to provide it. That’s what happens when you treat your business as a source of rent

Re: Acme, a brief history of one of the protocols which has changed the Internet

#50

Post by eimrine »

gorgoiler wrote: post #2

Thank you Let’s Encrypt , you changed the world and made it better. Sorry to everyone else who was listening in on the wire. Come back with a warrant, I guess?!

sorry to a basket of my old devices which I would still use
Post reply on HN