3 ms·

The fact I'm on Hacker News should probably give you an idea. I know it's relatively common on corporate intranets, but I don't use those. I can assure you that

The fact I'm on Hacker News should probably give you an idea. I know it's relatively common on corporate intranets, but I don't use those. I can assure you that I've used lots of CAs, banking sites, VPN providers, registrars, hosting providers (and plenty of others) and made no specific effort to avoid them, and StartSSL is (almost) the only one I've found. I've remembered that the UK Government Gateway used to use them about 10 years ago, but they were optional. My point was that you referred to all other security as "half-assed" (and implied I was too), which would make almost all other sites half-assed. Now there are a lot of sites with half-assed security, but I'm not sure you could call all of these half-assed: https://twofactorauth.org/ https://twofactorauth.org/ http://www.dongleauth.info/ http://www.dongleauth.info/

josteink 11y ago
> My point was that you referred to all other security as "half-assed" (and implied I was too), which would make almost all other sites half-assed. To be clear about that: My point about half-assed was your seeming unwillingness to back up client-certificates which gives full access to your real certificates and (in some cases) private certificate keys. Unless on Windows (where StartSSL has its private keys marked non-exportable in the certificate store, sic), doing such a backup takes almost no effort. There's no excuse for going all the way through to get a cert and then not bothering backing up these client-certs too.
- ascorbic 11y ago
  Even if it's easy (and it may be now - I haven't done it for a while), it's still a whole extra backup workflow, which I have to work out how to do for all different browsers, and if I'm on another machine work out how to import, and work out if it's possible on mobile, and oh look, my personal certificate has expired so I can't login to renew it so I need to create a new account to get a new certificate and email them to get the accounts merged...all for one site. Or ./letsencrypt-auto renew
  - josteink 11y ago
    Good for you, I guess. I've yet to have letsencrypt work a single one of my websites and I'll stick to StartSSL until it there's something better around.

josteink 11y ago

> My point was that you referred to all other security as "half-assed" (and implied I was too), which would make almost all other sites half-assed. To be clear about that: My point about half-assed was your seeming unwillingness to back up client-certificates which gives full access to your real certificates and (in some cases) private certificate keys. Unless on Windows (where StartSSL has its private keys marked non-exportable in the certificate store, sic), doing such a backup takes almost no effort. There's no excuse for going all the way through to get a cert and then not bothering backing up these client-certs too.

ascorbic 11y ago
Even if it's easy (and it may be now - I haven't done it for a while), it's still a whole extra backup workflow, which I have to work out how to do for all different browsers, and if I'm on another machine work out how to import, and work out if it's possible on mobile, and oh look, my personal certificate has expired so I can't login to renew it so I need to create a new account to get a new certificate and email them to get the accounts merged...all for one site. Or ./letsencrypt-auto renew
- josteink 11y ago
  Good for you, I guess. I've yet to have letsencrypt work a single one of my websites and I'll stick to StartSSL until it there's something better around.