4 ms·

CAs in practice don't verify who you are; they just verify that you are the entity that controls a particular domain name. LetsEncrypt does this automatically,

CAs in practice don't verify who you are; they just verify that you are the entity that controls a particular domain name. LetsEncrypt does this automatically, for free, and in a more user-friendly way. For information on the security considerations involved, see [1]. These are similar considerations to those of most DNS-based CA verification methods (which is most of them). [1] https://ietf-wg-acme.github.io/acme/draft-ietf-acme-acme.html#rfc.section.10 https://ietf-wg-acme.github.io/acme/draft-ietf-acme-acme.htm...

protomyth 9y ago
> CAs in practice don't verify who you are; they just verify that you are the entity that controls a particular domain name. Strangely, our CA called our human resource department to verify a lot of the information. I guess its all in who you chose.
- pfg 9y ago
  It's not about the CA, it's about the level of validation your chose. All major CAs offer all three levels of validation - DV, OV, EV. DV doesn't involve any verification of personal/company details, no matter the CA.
  - tialaramex 9y ago
    You don't get to say "all major CAs" referring to everybody else now, Let's Encrypt is definitely a major CA too now :-) Also some (maybe you don't think they're major?) don't offer DV. After all they can't be cheapest or fastest so why not focus on a product with higher value.
paulddraper 9y ago
> CAs in practice don't verify who you are; they just verify that you are the entity that controls a particular domain name. They do that at a minimum. OV and EV certs require more work and do verify who you are (for some definition of "who") and that's where the more expensive CA's add value.
LinuxBender 9y ago
How do we make it more obvious to non technical people the difference between a DV cert and other certs, in a way they will completely understand? I understand what the browsers do today and I don't believe this help protect people. It should be very clear what type of transport security is in use, along with a score and what type of identity has been verified and what that means. I honestly don't know the answer to this, but I do know the existing methods in browsers just doesn't give a clear picture to non technical people.

protomyth 9y ago

> CAs in practice don't verify who you are; they just verify that you are the entity that controls a particular domain name. Strangely, our CA called our human resource department to verify a lot of the information. I guess its all in who you chose.

pfg 9y ago
It's not about the CA, it's about the level of validation your chose. All major CAs offer all three levels of validation - DV, OV, EV. DV doesn't involve any verification of personal/company details, no matter the CA.
- tialaramex 9y ago
  You don't get to say "all major CAs" referring to everybody else now, Let's Encrypt is definitely a major CA too now :-) Also some (maybe you don't think they're major?) don't offer DV. After all they can't be cheapest or fastest so why not focus on a product with higher value.

paulddraper 9y ago

> CAs in practice don't verify who you are; they just verify that you are the entity that controls a particular domain name. They do that at a minimum. OV and EV certs require more work and do verify who you are (for some definition of "who") and that's where the more expensive CA's add value.

LinuxBender 9y ago

How do we make it more obvious to non technical people the difference between a DV cert and other certs, in a way they will completely understand? I understand what the browsers do today and I don't believe this help protect people. It should be very clear what type of transport security is in use, along with a score and what type of identity has been verified and what that means. I honestly don't know the answer to this, but I do know the existing methods in browsers just doesn't give a clear picture to non technical people.