Safari will no longer trust certs valid for more than 13 months

Post by Reelin » Sun, Feb 23, 2020, 9:41 PM UTC

xg15 wrote: post #78

brirec wrote: post #11

Earlier quoted context omitted.

I think you may not be very familiar with Let’s Encrypt’s challenges. Allow me to briefly explain the gist of them: The two most common challenges are an http challenge, and a DNS challenge. The http challenge gives you a response code to host as a file on the domain during the validation period. This challenge is, for all practical purposes, random, and cannot be guessed. Then, after your script tells Let’s Encrypt…

> DNS challenge is even more secure, in my opinion, as it works the same but the response code is stored in a TXT record for Let’s Encrypt to validate. In order to break this you would need control of the DNS servers. > Now let’s contrast this with, for instance, getting a multi-year certificate from the likes of Verisign or similar: this (as far as I am aware) requires manual interaction, which can at least theoreti…

Post by tialaramex » Sun, Feb 23, 2020, 9:46 PM UTC

xg15 wrote: post #78

brirec wrote: post #11

Earlier quoted context omitted.

I think you may not be very familiar with Let’s Encrypt’s challenges. Allow me to briefly explain the gist of them: The two most common challenges are an http challenge, and a DNS challenge. The http challenge gives you a response code to host as a file on the domain during the validation period. This challenge is, for all practical purposes, random, and cannot be guessed. Then, after your script tells Let’s Encrypt…

> DNS challenge is even more secure, in my opinion, as it works the same but the response code is stored in a TXT record for Let’s Encrypt to validate. In order to break this you would need control of the DNS servers. > Now let’s contrast this with, for instance, getting a multi-year certificate from the likes of Verisign or similar: this (as far as I am aware) requires manual interaction, which can at least theoreti…

Post by tialaramex » Sun, Feb 23, 2020, 9:52 PM UTC

brirec wrote: post #11

mamon wrote: post #4

Earlier quoted context omitted.

How will that automation verify that certificate is issued to the legal owner of the web site and not a hacker? Are the challenges used by Let's Encrypt secure? For me, automating certificate issuance will lead to less and less verification, to the point where having a valid certificate will become meaningless. EDIT: to clarify - there are two bad things about Let's Encrypt: 1. It's automated 2. It's free The fact th…

I think you may not be very familiar with Let’s Encrypt’s challenges. Allow me to briefly explain the gist of them: The two most common challenges are an http challenge, and a DNS challenge. The http challenge gives you a response code to host as a file on the domain during the validation period. This challenge is, for all practical purposes, random, and cannot be guessed. Then, after your script tells Let’s Encrypt…

Post by Reelin » Sun, Feb 23, 2020, 10:00 PM UTC

jhoechtl wrote: post #79

superkuh wrote: post #39

There are two mutually exclusive views of the web. As a set of protocols to allow individual humans to share information about things they love and the web as a set of protocols to make a living. There are real reasons for the for-profit web to want to limited cert lifetimes since revocation doesn't really work in practice. In terms of browser dev the two views are mutually exclusive and the one that funds the coders…

I am telling you there is a conspiracy going on to end the open and free web. We should fiercefully start to fight back otherwise those who made the internet great (the open source hackers working on LAMP) will loose everything.

Post by benibela » Sun, Feb 23, 2020, 10:17 PM UTC

superkuh wrote: post #48

derefr wrote: post #42

Earlier quoted context omitted.

CAs have always been third-party services, though. Their APIs just used to involve humans talking to humans, rather than machines talking to machines. But that's no less of an operational dependency. In a systems engineering plan (e.g. a NASA long-term project), both kinds of dependencies are considered liabilities that must be engineered for long-term reliability, fault-tolerance, etc.

In the past browsers did not scaremonger so much about self-signed certs and search engines would index sites that were just http and this didn't effect their ranking.