4 ms·

> Not totally surprising as I have never seen Let's Encrypt do anything that could be remotely considered diligence in not doing shady stuff. Mind elaborating?

> Not totally surprising as I have never seen Let's Encrypt do anything that could be remotely considered diligence in not doing shady stuff. Mind elaborating? I'm not familiar enough to know what shady stuff they've done, and I'm a happy user of LE so far. Would love to know more.

tialaramex 10y ago
People's general thrust has been that Let's Encrypt's approach means anybody who can control an FQDN can get a certificate for that FQDN and they don't like that. One group object that DV (Domain Validated) certificates which only validate control over the FQDN just shouldn't exist at all. They believe you should need to prove a "real world" identity to someone or else not be able to have a certificate. Obviously that would put HTTPS back to pretty rare, because proving real world identity costs money and requires some effort, whereas DV has been completely automated. Another group are fine with DV, except that they have an objection to nebulously defined "obviously bad" FQDNs. They argue (and they're not entirely wrong) that humans try to parse the FQDN for sense, and it leads them astray. They see microsoft-helpline in the FQDN and conclude it's a Microsoft helpline, or they see mybank-login-page and figure it's the log in page for their bank... Changing either of these things would be a radical policy alteration for the Web PKI. In the anti-DV group that might actually be seen as a good thing, a handful of CAs literally don't offer DV, their businesses could actually grow if DV were abolished. Right now, the Baseline Requirements which control how a public CA should behave to stay trusted in the Web PKI, say the CA must have a "High risk" list which protects some FQDN from being issued without human oversight. Let's Encrypt do operate such a list and since they have no human oversight if you hit the list you just can't get a certificate - about once a month somebody asks on their public forum about such a name, e.g. aa.edu ran into this, so did some outfit with the same initials as Deutsche Bank. However the BRs don't specify what must be on the list at all. I don't happen to think any of this is "shady" on the part of Let's Encrypt, but some people do.

tialaramex 10y ago

People's general thrust has been that Let's Encrypt's approach means anybody who can control an FQDN can get a certificate for that FQDN and they don't like that. One group object that DV (Domain Validated) certificates which only validate control over the FQDN just shouldn't exist at all. They believe you should need to prove a "real world" identity to someone or else not be able to have a certificate. Obviously that would put HTTPS back to pretty rare, because proving real world identity costs money and requires some effort, whereas DV has been completely automated. Another group are fine with DV, except that they have an objection to nebulously defined "obviously bad" FQDNs. They argue (and they're not entirely wrong) that humans try to parse the FQDN for sense, and it leads them astray. They see microsoft-helpline in the FQDN and conclude it's a Microsoft helpline, or they see mybank-login-page and figure it's the log in page for their bank... Changing either of these things would be a radical policy alteration for the Web PKI. In the anti-DV group that might actually be seen as a good thing, a handful of CAs literally don't offer DV, their businesses could actually grow if DV were abolished. Right now, the Baseline Requirements which control how a public CA should behave to stay trusted in the Web PKI, say the CA must have a "High risk" list which protects some FQDN from being issued without human oversight. Let's Encrypt do operate such a list and since they have no human oversight if you hit the list you just can't get a certificate - about once a month somebody asks on their public forum about such a name, e.g. aa.edu ran into this, so did some outfit with the same initials as Deutsche Bank. However the BRs don't specify what must be on the list at all. I don't happen to think any of this is "shady" on the part of Let's Encrypt, but some people do.