Why I won’t use Let’s Encrypt
stargrave.org
Why I won’t use Let’s Encrypt
1–10 of 14 posts
Re: Why I won’t use Let’s Encrypt
#2I just began to read your article and I'm already tired. Really?
Re: Why I won’t use Let’s Encrypt
#3It's not about authentication. There is no misconception among any educated person that just because there is an else certificate means that it is a trustworthy site. All it means is that the information is encrypted in transit. Google prefers sites that have TLS certificates installed and so everybody gets one from let's encrypt for free. Therefore their SEO is better.
The argument that if you create a key and put it on a VPS or shared service is effectively giving it to the service provider is true. But what does it matter. If you don't have an element of trust with your provider than where you hosting with them? And if you're that worried about it why not do full disc encryption on top of it all?
Re: Why I won’t use Let’s Encrypt
#4> LE is definitely a NOBUS. Neither I am going to support that, nor they allow me to (because of sanctions-related laws)
I think this statement does require some support, and the explanation for why the writer can't support it is both intentionally vague and conspiratorial.
Re: Why I won’t use Let’s Encrypt
#5Kind of an incoherent rant.
Half of it is about not wanting to pay $$$ for certs, which is really irrelevant if the question is why not use lets encrypt,not why not use some other service. The author also seems to be arguing at the same time that the webpki threat model is both too strict and not strict enough, which doesn't make for the most compelling argument (pick a side).
The only reason given for not wanting let's encrypt is that its usa based, and the author doesn't trust the us government. However the author totally ignores the primary control against that - namely certificate transparency, and the idea that even if us government has this capability (big if) they can only use it once and you're probably not valuable enough.
Re: Why I won’t use Let’s Encrypt
#6Better read http://n-gate.com/software/2017/07/12/0/, at least it's funny.
Re: Why I won’t use Let’s Encrypt
#7> LE is definitely a NOBUS. Neither I am going to support that, nor they allow me to (because of sanctions-related laws) I think this statement does require some support, and the explanation for why the writer can't support it is both intentionally vague and conspiratorial.
Yeah, I’d like some explanation of how the author “knows” LE is an NSA asset, and how one could determine that a CA is not an NSA asset. (And I won’t accept “all CAs are NSA assets” without some deeply compelling evidence)
Re: Why I won’t use Let’s Encrypt
#8It's not about authentication. There is no misconception among any educated person that just because there is an else certificate means that it is a trustworthy site. All it means is that the information is encrypted in transit. Google prefers sites that have TLS certificates installed and so everybody gets one from let's encrypt for free. Therefore their SEO is better. The argument that if you create a key and put i…
It is a bit about authentication - it is meant to authenticate you are talking to the owner of the domain (which is different from authenticating the person behind it).
Compare that to pure optimistic encryption which has very different properties than https.
[P.s. If anyone says OV and EV certs... those haven't been very effective so im ignoring them]
Re: Why I won’t use Let’s Encrypt
#9> Specifying LE in CAA means that I authorize noone to issue certificates for my domains, except for US-based forces. That is something I will never do, being the citizen of completely independent jurisdiction. I am not a traitor.
Uh... okay...
Re: Why I won’t use Let’s Encrypt
#10It's not about authentication. There is no misconception among any educated person that just because there is an else certificate means that it is a trustworthy site. All it means is that the information is encrypted in transit. Google prefers sites that have TLS certificates installed and so everybody gets one from let's encrypt for free. Therefore their SEO is better. The argument that if you create a key and put i…
> And if you're that worried about it why not do full disc encryption on top of it all?
It does not necessarily solve the problem. The provider could steal the keys in memory when the disc is accessed. Anyway, hosting stuff at home does not fully solve the issue: you still have to trust your machine's firmware / hardware. So… HTTPS should never be used?
The only guarantee HTTPS gives is that the communication between the client and the server is encrypted, not that the server is not compromised. HTTPS does not worsen the situation. Nobody should use HTTPS for authentication, that's not what it is for (edit: well, except the bit about domain ownership, agreed)