Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

10 Years of Let's Encrypt

letsencrypt.org

Post reply on HN
Print view View original

81–90 of 361 posts

Re: 10 Years of Let's Encrypt

#81

Post by bangaladore »

Uvix wrote: post #64
RonanSoleste wrote: post #59

Earlier quoted context omitted.

When you request an EV. They call you by the phone number that you give to ask if you requested a certificate. That was the complete extend of the validation. I could be a scammer with a specificity designed domain name and they would just accept it, no questions asked.

Depends on the registrar. Globalsign required the phone number to be one publicly listed for the company in some business registry (I forget exactly which one), so it had to be someone in our main corporate office who'd deal with them on the phone.

For an online business in a dubious (but legal) domain, my co-owner spent a few hundred bucks registering a business in New Mexico with a registered agent to get an EV cert.

So, a barrier to entry, but not much of one.

Re: 10 Years of Let's Encrypt

#82

Post by dingaling »

chippiewill wrote: post #54
p2detar wrote: post #41

Earlier quoted context omitted.

Not sure if you're joking or not, but I have to deal with this upcoming change at some point and still haven't read in detail why they decided to do this. Could anyone clarify?

Lets Encrypt are doing is because of the decision that CAs and browser makers made that it needs to be reduced (browsers have been reducing the length of certs that they trust). The why is because it's safer: it reduces the validity period of private keys that could be used in a MITM attack if they're leaked. It also encourages automation of cert renewal which is also more secure. It also makes responding to incident…

> it reduces the validity period of private keys that could be used in a MITM attack if they're leaked

If a private key is leaked, 45 days is sufficient to clean-out the accounts of all that company's customers. It might as well be 10 years.

If cert compromise is really common enough to require a response then the cert lifetime should be measured in minutes.

Re: 10 Years of Let's Encrypt

#83

Post by matrss »

wnevets wrote: post #68
RonanSoleste wrote: post #59

Earlier quoted context omitted.

When you request an EV. They call you by the phone number that you give to ask if you requested a certificate. That was the complete extend of the validation. I could be a scammer with a specificity designed domain name and they would just accept it, no questions asked.

> In addition to all of the authentication steps CAs take for DV and OV certificates, EV certificates require vetting of the business organization’s operational existence, physical address and a telephone call to verify the employment status of the requestor. [1] [1] https://www.digicert.com/difference-between-dv-ov-and-ev-ssl... Tying a phone number to a physical address and company is a lot more useful than just pr…

> Tying a phone number to a physical address and company is a lot more useful than just proof of control over a domain.

It might be useful in some cases, but it is never any more secure than domain validation. Which is why browsers don't treat it in a special way anymore, but if you want you can still get EV certificates.

Re: 10 Years of Let's Encrypt

#84

Post by tadfisher »

unethical_ban wrote: post #51
btown wrote: post #24

Earlier quoted context omitted.

To be fair, for a CEO in 2022, EV certificates had only lost their special visualizations since September/October 2019 with Chrome 77 and Firefox 70 - and with all that would happen in the following months, one could be forgiven for not adapting to new browser best practices! https://www.troyhunt.com/extended-validation-certificates-ar...

EV validated not only that a domain was under control of the server requesting the cert, but that the domain was under control of the entity claiming it. I kind of wish they still had it, and I kind of wish browsers indicated that a cert was signed by a global CA (real cert store trusted by the browsers) or an aftermarket CA, so people can see that their stuff is being decrypted by their company.

Problem is, I can easily set up a company and get an EV cert for "FooBar Technologies, LLC" and phish customers looking for "FooBar Incorporated" or "International FooBar Corp.". Approximately zero users know the actual entity name of the real FooBar.

Re: 10 Years of Let's Encrypt

#85

Post by ok123456 »

tptacek wrote: post #73
ok123456 wrote: post #66

Snowden was the other big reason that TLS became the de facto standard for every site. Prior to that, the consensus was that you only really needed TLS if you were dealing with money and wasn't worth the hassle otherwise. You could sniff traffic from Facebook and Twitter easily. I remember listening to a talk given by an IRS investigator in around 2008 about how they were able to do a sting and shutdown illegal inter…

This is a retcon. Facebook rolled out TLS in 2011, 2 years before Snowden, and went TLS-by-default within a month of the Snowden disclosures. Google Mail was TLS-by-default in 2010. TLS was a universal best practice long before 2013 --- by 2010, you'd have gotten a sev:hi vulnerability flagged on your site if you hadn't implemented TLS. SSLLabs was 2009; BEAST was 2011, and was a huge global news story because of how…

Yes. And I remember sniffing Facebook traffic in clear text in 2011. The fact remains that it was considered a significant engineering problem for them to deploy it. It was a "best practice" that most people rolled their eyes at.

Most users and system owners didn't care unless money was being transacted.

Between Snowden and ISPs injecting content into pages, the consensus changed.

Re: 10 Years of Let's Encrypt

#86

Post by dylan604 »

ZeroConcerns wrote: post #14
Aardwolf wrote: post #3

Earlier quoted context omitted.

Agreed! What were we using before Let's Encrypt again? Maybe just plain HTTP

Mostly Verisign, which required faxing forms and eye-watering amounts of money. Then Thawte, which brought down prices to a more manageable US$500 per host or so. Which might seem excessive, but was really peanuts compared to the price of the 'SSL accelerator' SBus card that you also needed to serve more than, like, 2 concurrent HTTPS connections. And you try telling young people that ACME is a walk in the park, and…

As GP posited, because of this headache, lots of web traffic was plain ol' HTTP. Let's Encrypt is owed a lot of credit for drastically reducing plain ol' HTTP.

Re: 10 Years of Let's Encrypt

#87

Post by t1234s »

Lets hope they stay independent and never get acquired by Google or any other large tech company. You can imagine a web where SSL issuance is used as a tool to censor websites. I think most browsers have been made to make standard http sites look malicious to normal users.

Re: 10 Years of Let's Encrypt

#89

Post by realityking »

RonanSoleste wrote: post #59
wnevets wrote: post #52

Earlier quoted context omitted.

> Call me old-school, but I really liked how EV certs looked in the browser. I agree, making EV Certs visually more important makes sense to people who know what it means and what it doesn't. Too bad they never made it an optional setting.

When you request an EV. They call you by the phone number that you give to ask if you requested a certificate. That was the complete extend of the validation. I could be a scammer with a specificity designed domain name and they would just accept it, no questions asked.

EV certs also showed the legal name of the company that requested the certificate - that was an advantage.

Re: 10 Years of Let's Encrypt

#90

Post by foresto »

Analemma_ wrote: post #19
jjice wrote: post #5

Let's Encrypt was _huge_ in making it's absurd to not have TLS and now we (I, at least) take it for granted because it's just the baseline for any website I build. Incredible, free service that helped make the web a more secure place. What a wonderful service - thank you to the entire team. The CEO at my last company (2022) refused to use Let's Encrypt because "it looked cheap to customers". That is absurd to me beca…

I've seen people complain that Let's Encrypt is so easy that it's enabling the forced phaseout of long-lived certificates and unencrypted HTTP. I sort of understand this, although it does feel like going "bcrypt is so easy to use it's enabling standards agencies to force me to use something newer than MD5". Like, yeah, once the secure way is sufficiently easy to use, we can then push everyone off the insecure way; th…

I can understand this in in certain contexts, such as a site that exists solely to post public information of no value to an attacker.

A local volunteer group that posts their event schedule to the web were compelled to take on the burden of https just to keep their site from being labeled as a potential threat. They don't have an IT department. They aren't tech people. The change multiplied the hassles of maintaining their site. To them, it is all additional cost with no practical benefit over what they had before.

Post reply on HN