Acme, a brief history of one of the protocols which has changed the Internet
1–10 of 91 posts
Re: Acme, a brief history of one of the protocols which has changed the Internet
#2Thank you Let’s Encrypt, you changed the world and made it better.
Sorry to everyone else who was listening in on the wire. Come back with a warrant, I guess?!
Re: Acme, a brief history of one of the protocols which has changed the Internet
#3Thank you for your service
Re: Acme, a brief history of one of the protocols which has changed the Internet
#4Thank you Let’s Encrypt , you changed the world and made it better. Sorry to everyone else who was listening in on the wire. Come back with a warrant, I guess?!
Seriously, talk about impact. That one non-profit has almost single-handedly encrypted most of the web, 700 million sites now! Amazing work.
Re: Acme, a brief history of one of the protocols which has changed the Internet
#5Has anyone considered the possibility that a CA such as Let's Encrypt could be compromised or even run entirely by intelligence operatives? Of course, there are many other CAs that could be compromised and making money off of customers on top of that. But who knows... What could defend against this possibility? Multiple signatures on a certificate?
Re: Acme, a brief history of one of the protocols which has changed the Internet
#6I remember deploying SSL on NetWare in the late 1990s and being given ... something that the US allowed to be exported as a munition!
I don't recall the exact details but it was basically buggered - short key length. Long enough to challenge a 80386 Beowulf cluster but no match for whatever was humming away in a very well funded machine room.
You could still play with all the other exciting dials and knobs, SANs and so on but in the end it was pretty worthless.
Re: Acme, a brief history of one of the protocols which has changed the Internet
#7Has anyone considered the possibility that a CA such as Let's Encrypt could be compromised or even run entirely by intelligence operatives? Of course, there are many other CAs that could be compromised and making money off of customers on top of that. But who knows... What could defend against this possibility? Multiple signatures on a certificate?
A signature on a certificate doesn't allow CA to snoop. They need access to the private key for that, which ACME (and other certificate signing protocols in general) doesn't share with the CA.
Re: Acme, a brief history of one of the protocols which has changed the Internet
#8Let's Encrypt did more for privacy than any other organization. Before Let's Encrypt, we'd usually deploy TLS certificates, but as somewhat of an afterthought, and leaving HTTP accessible. They were a pain to (very manually) rotate once a year, too.
It's hard to overstate just how much LE changed things. They made TLS the default, so much that you didn't have to keep unencrypted HTTP around any more. Kudos.
Re: Acme, a brief history of one of the protocols which has changed the Internet
#9I remember deploying SSL on NetWare in the late 1990s and being given ... something that the US allowed to be exported as a munition! I don't recall the exact details but it was basically buggered - short key length. Long enough to challenge a 80386 Beowulf cluster but no match for whatever was humming away in a very well funded machine room. You could still play with all the other exciting dials and knobs, SANs and…
A few years ago a client of mine gave me a big-ish APC UPS. I recently got new batteries for it after the outage here in Portugal, and to turn on SSH I had to agree that I was not a terrorist organisation's nor in a country where encryption can not be exported to.
Re: Acme, a brief history of one of the protocols which has changed the Internet
#10Has anyone considered the possibility that a CA such as Let's Encrypt could be compromised or even run entirely by intelligence operatives? Of course, there are many other CAs that could be compromised and making money off of customers on top of that. But who knows... What could defend against this possibility? Multiple signatures on a certificate?
A signature on a certificate doesn't allow CA to snoop. They need access to the private key for that, which ACME (and other certificate signing protocols in general) doesn't share with the CA.
I know that. But presumably, Let's Encrypt could participate in a MITM attack since they can sign another key, so that even the visitor who knows that you use them as a CA can't tell there is a MITM. Checking multiple signatures on the same key could raise the bar for a MITM attack, requiring multiple CA's to participate. I can't be the first person to think of this. I'm not even a web security guy.
It might be interesting for ACME to be updated to support signing the same key with multiple CA's. Three sounds like a good number. You ought to be able to trust CA's enough to believe that there won't be 3 of them conspiring against you, but you never really know.