5 ms·
This is absolutely FUD, even if you don't intend it to be. By what mechanism do you suppose the TLA boogeymen could compel ISRG to give up their private keys, a
by andreyf 11y ago
This is absolutely FUD, even if you don't intend it to be. By what mechanism do you suppose the TLA boogeymen could compel ISRG to give up their private keys, and how would a team of lawyers make one exempt from such mechanisms?
Let's Encrypt is the effort of a benefit corp (ISRG) run by people who care about security and privacy enough to bake it into the foundations of the organization [1]. I think this makes them more trustworthy than for-profit CA's, which have a history of misunderstanding the fundamental roles they play in the security chain, e.g. [2].
1. https://en.wikipedia.org/wiki/Internet_Security_Research_Group https://en.wikipedia.org/wiki/Internet_Security_Research_Gro...
2. http://www.computerworld.com/article/2501291/internet/trustwave-admits-issuing-man-in-the-middle-digital-certificate--mozilla-debates-punishment.html http://www.computerworld.com/article/2501291/internet/trustw...
- mangeletti 11y agoBy EXACTLY the same means as last time[1]. Lavabit waa ordered to give up their private key, despite the fact that Lavabit wasn't, itself, under investigation. In other words, they were forced to give up their clients privacy and were given a gag orders. Attorneys don't exempt anyone from anything, but your comment seems to suggest their existence is for entertainment. A team of attorneys might have found a way out of the mess for Lavabit. 1. https://en.m.wikipedia.org/wiki/Lavabit https://en.m.wikipedia.org/wiki/Lavabit
- andreyf 11y agoLavabit held an encryption key that could decrypt evidence of a crime. They received a subpoena for that key. They followed what was likely any lawyer's advice to comply with the lawful subpoena (ordered by a judge, not a TLA). This reasoning would not apply to CA's.