3 ms·

I truly appreciate the hard work Let's Encrypt is doing. However, this is not free. In return for getting an SSL certificate, your users will need to trust an

I truly appreciate the hard work Let's Encrypt is doing. However, this is not free. In return for getting an SSL certificate, your users will need to trust an organization to protect the secrets they share with you and vice versa. This organization has no economic incentive to do good for you or to do harm to you. What happens when this organization is compelled by the TLA to give up the lucky charms, and there is no team of attorneys to fight back, and no billions at stake, and there is a gag order? And, given the rate at which a "free" SSL certificate will proliferate, these will be some valuable lucky charms. This is not FUD. This is simply recognizing that "free" SSL certificates don't really address the issues that arise from centralized authority in a decentralized economy.

vbezhenar 11y ago
You protect your secrets with your private key. That organization is only assures that this particular key belongs to your site. They don't have access to your key. Users don't need to trust anything they don't trust yet.
- mangeletti 11y ago
  Which is the whole value proposition of a CA. Without this, a website and its clients are vulnerable to MitM attacks.
  - computator 11y ago
    But not vulnerable to passive wholesale eavesdropping that the NSA and likely other worldwide spies agencies have been doing.
    - mangeletti 11y ago
      If vulnerability to active spying is some sort of consultation prize, then why don't browsers disable CA checks and we can all self-sign?
idibidiart 11y ago
I personally argued with the W3C TAG against an HTTPS-only web for this reason. Tim Berners Lee, who heads the TAG, ceremonially speaking, argued against it, too, but on different ground. The browser vendor 'experts' on the TAG totally dismissed any and all argument against forcing everyone to use HTTPS. They were basically told by their employers (the big browser vendors and CDNs like Akamai) to make it happen. HTTPS is a rather costly false sense of security. Now anyone who wants to setup a website, for whatever reason, has to go thru some central authority in the name of "securing the web" (LOL) but it's just another way to control free speech and what people do with the web.
- mangeletti 11y ago
  It's worth noting that Akamai is on the board of the parent organization of Let's Encrypt.
- johncolanduoni 11y ago
  > it's just another way to control free speech and what people do with the web How so? Do you expect browsers to stop serving content from sites using boring old HTTP? And the fact is that we've had to go through a central authority to put a website up for a long time, with DNS.
- bandrami 11y ago
  Thank you. Demanding TLS while insisting on keeping our broken PKI alive is saying that anonymous publishing is impossible. Just look at the stupid way browsers treat self-signed certificates: these are strictly better than plaintext, but plaintext gets no warning and self-signed certificates are warned about and in some cases actually blocked. Similarly, one mailer (exim, I think?) on seeing an untrusted certificate would actually downgrade to plaintext. There aren't enough palms or enough faces for that.
  - icebraining 11y ago
    Just look at the stupid way browsers treat self-signed certificates: these are strictly better than plaintext, but plaintext gets no warning and self-signed certificates are warned about and in some cases actually blocked. Technically, yes. UI-wise, no. People have different expectations for https:// https:// URLs, which would be broken if browsers simply accepted any self-signed cert. No excuse for the mailer behaviour, though.
stephen_g 11y ago
What secrets are shared? Your private key stays on your server, the CA's private key on theirs... The main thing that you trust (every) CA to do is to not issue a certificate for your domain to somebody else.
- mangeletti 11y ago
  If I know Let's Encrypt's secrets, and I control your network, I can set up a valid certificate on my server and MitM you.
  - johncolanduoni 11y ago
    ... as could any other CA your browser trusts. What makes Let's Encrypt any worse?
    - bandrami 11y ago
      It's not worse; it's just exactly the same broken model, now for no money and being pushed on everyone. All this because a couple of theorists in the 1990s decided that security requires authenticity, despite decades of research to the contrary. There are all kinds of ways to establish authenticity of counterparties. Entire books are written about that. There are much better ways than our current CA model. But we don't need any of them to have passively secure transport, over which we can then negotiate authenticity. This is arranging deck chairs on the Hindenburg. It's nice that people will (once they finally get around to issuing certs "in mid-2015") be able to have zero-cost certs, but it doesn't change the fundamental broken-ness and wrong-headedness of having CAs in the first place.
      - icebraining 11y ago
        Who claims that you can't have a passively secured transport without authentication? I mean, SSL/TLS itself uses DH key exchange, which can be used for that purpose. The problem is having secured transport against active attacks as well, and without forcing the user to know anything about the site besides its domain.
andreyf 11y ago
This is absolutely FUD, even if you don't intend it to be. By what mechanism do you suppose the TLA boogeymen could compel ISRG to give up their private keys, and how would a team of lawyers make one exempt from such mechanisms? Let's Encrypt is the effort of a benefit corp (ISRG) run by people who care about security and privacy enough to bake it into the foundations of the organization [1]. I think this makes them more trustworthy than for-profit CA's, which have a history of misunderstanding the fundamental roles they play in the security chain, e.g. [2]. 1. https://en.wikipedia.org/wiki/Internet_Security_Research_Group https://en.wikipedia.org/wiki/Internet_Security_Research_Gro... 2. http://www.computerworld.com/article/2501291/internet/trustwave-admits-issuing-man-in-the-middle-digital-certificate--mozilla-debates-punishment.html http://www.computerworld.com/article/2501291/internet/trustw...
- mangeletti 11y ago
  By EXACTLY the same means as last time[1]. Lavabit waa ordered to give up their private key, despite the fact that Lavabit wasn't, itself, under investigation. In other words, they were forced to give up their clients privacy and were given a gag orders. Attorneys don't exempt anyone from anything, but your comment seems to suggest their existence is for entertainment. A team of attorneys might have found a way out of the mess for Lavabit. 1. https://en.m.wikipedia.org/wiki/Lavabit https://en.m.wikipedia.org/wiki/Lavabit
  - andreyf 11y ago
    Lavabit held an encryption key that could decrypt evidence of a crime. They received a subpoena for that key. They followed what was likely any lawyer's advice to comply with the lawful subpoena (ordered by a judge, not a TLA). This reasoning would not apply to CA's.
colinbartlett 11y ago
You state "This is not FUD" yet that's exactly what it strikes me as since making a certificate $0 instead of $19 doesn't change anything at all about "the issues that arise from centralized authority in a decentralized economy".
- mangeletti 11y ago
  Except that the company charging you $19 is getting $19 to provide a service to you, and their brand depends on that.
  - schoen 11y ago
    I don't think this distinction is especially relevant in this context. Let's Encrypt also has a brand that depends on its integrity, and if you're concerned about attempts to coerce certificate misissuance, they apply at least as strongly to for-profit entities.
schoen 11y ago
I think there's a misconception here about the CA model. Let's Encrypt users (in almost every respect) are not more exposed to risks of Let's Encrypt misissuing certificates. (They are more exposed to risks of Let's Encrypt wrongly revoking a certificate, but that creates an availability risk rather than an integrity or confidentiality risk.) In particular, Let's Encrypt never has access to your server's private key or to your TLS session keys. There is no way that Let's Encrypt could take a recorded TLS session and tell somebody how to decrypt it; what we have are signing keys, and all that they ever do is sign things (normally claims about other keys that could be used for other purposes). Although Let's Encrypt, like any CA, could issue an additional fake certificate which someone who controls your network could use to impersonate you, any site is already exposed to this risk from every CA, whether or not the site uses Let's Encrypt. Let's Encrypt could issue a fake certificate in the name of a site that uses StartSSL or Verisign -- or Verisign or StartSSL could issue a fake certificate in the name of a site that uses Let's Encrypt. As I've said a number of times in a number of contexts, the people working on the Let's Encrypt project don't think that this model is perfect, and many of us have been involved in expressing concerns about CAs' power in the past. As a result, we're working to limit Let's Encrypt's own power to misissue certificates by participating in the Certificate Transparency system, and hopefully by adopting and encouraging our users to adopt other technologies that will protect them against misbehavior by CAs, including us. We encourage our users (and non-users) to adopt technologies that would reduce the need to trust us, including HPKP, which lets sites themselves make assertions about what keys they'll use, which browsers will then enforce even if CAs say something different, and Certificate Transparency, which lets people confirm that certificates they encounter in the wild have been publicly disclosed worldwide by the CA that issued them. If you have other ideas for how CAs can be made less trusted, more transparent, and more accountable, we would love to hear them! And let me express my appreciation for the people who have been working to create the means that we have to do this today. (If you're not a Let's Encrypt user and want to protect visitors to your site against risk of misissuance of a certificate by Let's Encrypt -- or any other CA! -- you can also adopt CAA and HPKP, to give visitors a browser-side way to enforce your intentions about what certificates they should be accepting.)
- schoen 11y ago
  Let me also add that there is a "team of lawyers" to help resist attempts to force ISRG to violate its policies or betray its users. It's not clear to me that all for-profit CAs would resist such attempts better than a CA founded by EFF and Mozilla and with a Stanford law professor on the board. I'll also note that ISRG is publishing legal transparency reports, something which is still not very common in the CA industry. https://letsencrypt.org/documents/ISRG-Legal-Transparency-Report-July-1-2015.pdf https://letsencrypt.org/documents/ISRG-Legal-Transparency-Re...

vbezhenar 11y ago

You protect your secrets with your private key. That organization is only assures that this particular key belongs to your site. They don't have access to your key. Users don't need to trust anything they don't trust yet.

mangeletti 11y ago
Which is the whole value proposition of a CA. Without this, a website and its clients are vulnerable to MitM attacks.
- computator 11y ago
  But not vulnerable to passive wholesale eavesdropping that the NSA and likely other worldwide spies agencies have been doing.
  - mangeletti 11y ago
    If vulnerability to active spying is some sort of consultation prize, then why don't browsers disable CA checks and we can all self-sign?

idibidiart 11y ago

I personally argued with the W3C TAG against an HTTPS-only web for this reason. Tim Berners Lee, who heads the TAG, ceremonially speaking, argued against it, too, but on different ground. The browser vendor 'experts' on the TAG totally dismissed any and all argument against forcing everyone to use HTTPS. They were basically told by their employers (the big browser vendors and CDNs like Akamai) to make it happen. HTTPS is a rather costly false sense of security. Now anyone who wants to setup a website, for whatever reason, has to go thru some central authority in the name of "securing the web" (LOL) but it's just another way to control free speech and what people do with the web.

mangeletti 11y ago
It's worth noting that Akamai is on the board of the parent organization of Let's Encrypt.
johncolanduoni 11y ago
> it's just another way to control free speech and what people do with the web How so? Do you expect browsers to stop serving content from sites using boring old HTTP? And the fact is that we've had to go through a central authority to put a website up for a long time, with DNS.
bandrami 11y ago
Thank you. Demanding TLS while insisting on keeping our broken PKI alive is saying that anonymous publishing is impossible. Just look at the stupid way browsers treat self-signed certificates: these are strictly better than plaintext, but plaintext gets no warning and self-signed certificates are warned about and in some cases actually blocked. Similarly, one mailer (exim, I think?) on seeing an untrusted certificate would actually downgrade to plaintext. There aren't enough palms or enough faces for that.
- icebraining 11y ago
  Just look at the stupid way browsers treat self-signed certificates: these are strictly better than plaintext, but plaintext gets no warning and self-signed certificates are warned about and in some cases actually blocked. Technically, yes. UI-wise, no. People have different expectations for https:// https:// URLs, which would be broken if browsers simply accepted any self-signed cert. No excuse for the mailer behaviour, though.

stephen_g 11y ago

What secrets are shared? Your private key stays on your server, the CA's private key on theirs... The main thing that you trust (every) CA to do is to not issue a certificate for your domain to somebody else.

mangeletti 11y ago
If I know Let's Encrypt's secrets, and I control your network, I can set up a valid certificate on my server and MitM you.
- johncolanduoni 11y ago
  ... as could any other CA your browser trusts. What makes Let's Encrypt any worse?
  - bandrami 11y ago
    It's not worse; it's just exactly the same broken model, now for no money and being pushed on everyone. All this because a couple of theorists in the 1990s decided that security requires authenticity, despite decades of research to the contrary. There are all kinds of ways to establish authenticity of counterparties. Entire books are written about that. There are much better ways than our current CA model. But we don't need any of them to have passively secure transport, over which we can then negotiate authenticity. This is arranging deck chairs on the Hindenburg. It's nice that people will (once they finally get around to issuing certs "in mid-2015") be able to have zero-cost certs, but it doesn't change the fundamental broken-ness and wrong-headedness of having CAs in the first place.
    - icebraining 11y ago
      Who claims that you can't have a passively secured transport without authentication? I mean, SSL/TLS itself uses DH key exchange, which can be used for that purpose. The problem is having secured transport against active attacks as well, and without forcing the user to know anything about the site besides its domain.

andreyf 11y ago

This is absolutely FUD, even if you don't intend it to be. By what mechanism do you suppose the TLA boogeymen could compel ISRG to give up their private keys, and how would a team of lawyers make one exempt from such mechanisms? Let's Encrypt is the effort of a benefit corp (ISRG) run by people who care about security and privacy enough to bake it into the foundations of the organization [1]. I think this makes them more trustworthy than for-profit CA's, which have a history of misunderstanding the fundamental roles they play in the security chain, e.g. [2]. 1. https://en.wikipedia.org/wiki/Internet_Security_Research_Group https://en.wikipedia.org/wiki/Internet_Security_Research_Gro... 2. http://www.computerworld.com/article/2501291/internet/trustwave-admits-issuing-man-in-the-middle-digital-certificate--mozilla-debates-punishment.html http://www.computerworld.com/article/2501291/internet/trustw...

mangeletti 11y ago
By EXACTLY the same means as last time[1]. Lavabit waa ordered to give up their private key, despite the fact that Lavabit wasn't, itself, under investigation. In other words, they were forced to give up their clients privacy and were given a gag orders. Attorneys don't exempt anyone from anything, but your comment seems to suggest their existence is for entertainment. A team of attorneys might have found a way out of the mess for Lavabit. 1. https://en.m.wikipedia.org/wiki/Lavabit https://en.m.wikipedia.org/wiki/Lavabit
- andreyf 11y ago
  Lavabit held an encryption key that could decrypt evidence of a crime. They received a subpoena for that key. They followed what was likely any lawyer's advice to comply with the lawful subpoena (ordered by a judge, not a TLA). This reasoning would not apply to CA's.

colinbartlett 11y ago

You state "This is not FUD" yet that's exactly what it strikes me as since making a certificate $0 instead of $19 doesn't change anything at all about "the issues that arise from centralized authority in a decentralized economy".

mangeletti 11y ago
Except that the company charging you $19 is getting $19 to provide a service to you, and their brand depends on that.
- schoen 11y ago
  I don't think this distinction is especially relevant in this context. Let's Encrypt also has a brand that depends on its integrity, and if you're concerned about attempts to coerce certificate misissuance, they apply at least as strongly to for-profit entities.

schoen 11y ago

I think there's a misconception here about the CA model. Let's Encrypt users (in almost every respect) are not more exposed to risks of Let's Encrypt misissuing certificates. (They are more exposed to risks of Let's Encrypt wrongly revoking a certificate, but that creates an availability risk rather than an integrity or confidentiality risk.) In particular, Let's Encrypt never has access to your server's private key or to your TLS session keys. There is no way that Let's Encrypt could take a recorded TLS session and tell somebody how to decrypt it; what we have are signing keys, and all that they ever do is sign things (normally claims about other keys that could be used for other purposes). Although Let's Encrypt, like any CA, could issue an additional fake certificate which someone who controls your network could use to impersonate you, any site is already exposed to this risk from every CA, whether or not the site uses Let's Encrypt. Let's Encrypt could issue a fake certificate in the name of a site that uses StartSSL or Verisign -- or Verisign or StartSSL could issue a fake certificate in the name of a site that uses Let's Encrypt. As I've said a number of times in a number of contexts, the people working on the Let's Encrypt project don't think that this model is perfect, and many of us have been involved in expressing concerns about CAs' power in the past. As a result, we're working to limit Let's Encrypt's own power to misissue certificates by participating in the Certificate Transparency system, and hopefully by adopting and encouraging our users to adopt other technologies that will protect them against misbehavior by CAs, including us. We encourage our users (and non-users) to adopt technologies that would reduce the need to trust us, including HPKP, which lets sites themselves make assertions about what keys they'll use, which browsers will then enforce even if CAs say something different, and Certificate Transparency, which lets people confirm that certificates they encounter in the wild have been publicly disclosed worldwide by the CA that issued them. If you have other ideas for how CAs can be made less trusted, more transparent, and more accountable, we would love to hear them! And let me express my appreciation for the people who have been working to create the means that we have to do this today. (If you're not a Let's Encrypt user and want to protect visitors to your site against risk of misissuance of a certificate by Let's Encrypt -- or any other CA! -- you can also adopt CAA and HPKP, to give visitors a browser-side way to enforce your intentions about what certificates they should be accepting.)

schoen 11y ago
Let me also add that there is a "team of lawyers" to help resist attempts to force ISRG to violate its policies or betray its users. It's not clear to me that all for-profit CAs would resist such attempts better than a CA founded by EFF and Mozilla and with a Stanford law professor on the board. I'll also note that ISRG is publishing legal transparency reports, something which is still not very common in the CA industry. https://letsencrypt.org/documents/ISRG-Legal-Transparency-Report-July-1-2015.pdf https://letsencrypt.org/documents/ISRG-Legal-Transparency-Re...