5 ms·

It’s a sign of trouble, but I’m not sure it’s really “further” trouble, all it takes is for them to get a cert from Let’s Encrypt and call it a day. I’m surpris

It’s a sign of trouble, but I’m not sure it’s really “further” trouble, all it takes is for them to get a cert from Let’s Encrypt and call it a day. I’m surprised they weren’t using LE to begin with actually - since LE is available, why would you ever pay for another CA (excluding EV certificates)?

userbinator 9y ago
...and then LE also revokes their certificate.
- mynewtb 9y ago
  That is a really farfetched scenario which I would never imagine happening. LE are not Cloudflare, I am sure they would not ridicule their neutral mission without actual legal force.
  - sillysaurus3 9y ago
    Unfortunately it's not far fetched. I wish it were. It's just an unpleasant thought we've decided not to think about. LE are a US corp, subject to US laws, and at the whim of US court orders. The implications of that are worth gaming out. Our laws are (arguably) mostly fair. But there are cases where they're not. Picture a world where an administration rises to power in the US on a platform that seems insane, but everybody endorses it anyway. And this platform just so happens to be against the sort of thing you're trying to do on the internet. Sci-hub are stealing. We as a community are mostly fine with that. We don't consider it stealing, because the moral good outweighs the bad by a hundred to one. But this isn't about Sci-hub. This is about a world in which we're free to do as we please, because we have the ability to decide what we want to do. If we want to make a site that can make information available, and someone else doesn't like that information or feels that they own it, what do you do? You have no power. And when you blindly put your faith in institutions like Let's Encrypt on their platform of openness and trust, you set yourself up for a shift: One day you wake up and find out you were mistaken, and we were all mistaken to push this centralized model in the name of security and convenience. And of course, that's the fundamental truth, isn't it? Liberties have always been eroded by pushing security and convenience. We should think carefully about who we trust, and why.
    - JamesBarney 9y ago
      Sorry this is a pet peeve of mine, but I don't think sci-hub is stealing, it's infringing copyright. And this is one of those instances where I think what words we use to describe what sci-hub is doing matters.
  - userbinator 9y ago
    without actual legal force. That's precisely the main concern here, given the nature of SciHub.
- gsich 9y ago
  At this point you could go back to HTTP. And for LE: close down the company if that happens.
  - saagarjha 9y ago
    But then you have the issue of browsers marking your website as insecure, ISPs taking it upon themselves to enforce censorship, etc.
    - gsich 9y ago
      Yes. But at least as a company, you will still have your dignity. To not become a government pet.
      - saagarjha 9y ago
        Really? A "government pet"?
        gsich 9y ago
        better name?
mynameisvlad 9y ago
There are plenty of reasons to pay for a certificate. Wildcard certificates only came out last month on LE, and people might still be weary to switch their primary site over so quickly. Additionally, there's still a few cases I can think of where a custom certificate might be needed. For instance, I recently consolidated my personal projects and site onto one server. I needed a single certificate that'd cover two domains. Digicert combined two of my orders into one certificate with two wildcard SANs. You wouldn't be able to do that with LE. Edit: I was under the impression you couldn't do multiple wildcard SANs in LE but according to some forum posts it's fully possible as long as validation passes.
- gsich 9y ago
  Besides having a fancy name in the URL bar I can't think of any.
  - Symbiote 9y ago
    Using TLS on a server which doesn't have outbound/inbound access to the Internet/LetsEncrypt servers. Sharing a (wildcard) certificate between multiple servers.
    - gsich 9y ago
      Thats a distribution problem. You don't need to be accessible from the outside internet to use a LE certificate. You can request a cert from another one, then copy it. (Either manually or automatically, that is up to you)
- comex 9y ago
  You can definitely get certs from LetsEncrypt that have SANs for multiple unrelated domains. I haven’t tried out wildcard certificates at all yet, but I would be surprised if it didn’t allow combining those features…
  - timlardner 9y ago
    I've got two wildcard domains that are completely unrelated from LetsEncrypt.
sillysaurus3 9y ago
This is a much bigger deal than people are giving it credit for. At any point in history, have CAs revoked certs solely to censor a target website? Maybe the answer is yes. I don't know. But this is a rude wake-up call for me and everyone else who tried to force the world into this shape. We've all been shouting "You have to use TLS! It's fundamental security 101. If you're not using https, your site is probably broken. And there's no reason not to do it, since it's so easy." Surprise: Now nobdoy trusts http, and those that control https can revoke their trust based on arbitrary human morals rather than solid technical reasons. I was a pentester for years and not once did anybody mention this threat anywhere. It's blindingly obvious in hindsight, but it was too easy not to think about it. Let's Encrypt is in the exact same position. Why do we trust them? Think about it -- they're under US jurisdiction and subject to US laws. The government could compel them to revoke certs. We're lucky that it's just a minor annoyance. Picture a world where no major browser renders http at all, and the only way to get a site online is to have a trusted cert. This is not far from reality: If the Magic Leap turns out not to be vaporware, they're going to be launching a DRM-powered internet that can't be adblocked. And that means we'll all be subject to government whims far more than we'd like to admit.
- maxerickson 9y ago
  All the various DNS alternatives people have pitched over the years pretty directly address the centralization issue you are getting at here. Often by casting themselves as decentralized. Really the issue is that decentralization isn't very compatible with convenience and people generally place a lot more value on convenience than things like Sci-Hub.
- ams6110 9y ago
  Self-signed certificates, trust on first use (or verify out of band) like SSH, works around most of this
  - ethbro 9y ago
    Correct me if I'm wrong, but the signed server-identifying cert is swapped in TLS before the connection is encrypted, no? So it's not technically infeasible to have networking gear drop any connection which doesn't chain back to a government-approved root?
bdcravens 9y ago
If you're on AWS it's easy enough to just use their CA with ALB

userbinator 9y ago

...and then LE also revokes their certificate.

mynewtb 9y ago
That is a really farfetched scenario which I would never imagine happening. LE are not Cloudflare, I am sure they would not ridicule their neutral mission without actual legal force.
- sillysaurus3 9y ago
  Unfortunately it's not far fetched. I wish it were. It's just an unpleasant thought we've decided not to think about. LE are a US corp, subject to US laws, and at the whim of US court orders. The implications of that are worth gaming out. Our laws are (arguably) mostly fair. But there are cases where they're not. Picture a world where an administration rises to power in the US on a platform that seems insane, but everybody endorses it anyway. And this platform just so happens to be against the sort of thing you're trying to do on the internet. Sci-hub are stealing. We as a community are mostly fine with that. We don't consider it stealing, because the moral good outweighs the bad by a hundred to one. But this isn't about Sci-hub. This is about a world in which we're free to do as we please, because we have the ability to decide what we want to do. If we want to make a site that can make information available, and someone else doesn't like that information or feels that they own it, what do you do? You have no power. And when you blindly put your faith in institutions like Let's Encrypt on their platform of openness and trust, you set yourself up for a shift: One day you wake up and find out you were mistaken, and we were all mistaken to push this centralized model in the name of security and convenience. And of course, that's the fundamental truth, isn't it? Liberties have always been eroded by pushing security and convenience. We should think carefully about who we trust, and why.
  - JamesBarney 9y ago
    Sorry this is a pet peeve of mine, but I don't think sci-hub is stealing, it's infringing copyright. And this is one of those instances where I think what words we use to describe what sci-hub is doing matters.
- userbinator 9y ago
  without actual legal force. That's precisely the main concern here, given the nature of SciHub.
gsich 9y ago
At this point you could go back to HTTP. And for LE: close down the company if that happens.
- saagarjha 9y ago
  But then you have the issue of browsers marking your website as insecure, ISPs taking it upon themselves to enforce censorship, etc.
  - gsich 9y ago
    Yes. But at least as a company, you will still have your dignity. To not become a government pet.
    - saagarjha 9y ago
      Really? A "government pet"?
      - gsich 9y ago
        better name?

mynameisvlad 9y ago

There are plenty of reasons to pay for a certificate. Wildcard certificates only came out last month on LE, and people might still be weary to switch their primary site over so quickly. Additionally, there's still a few cases I can think of where a custom certificate might be needed. For instance, I recently consolidated my personal projects and site onto one server. I needed a single certificate that'd cover two domains. Digicert combined two of my orders into one certificate with two wildcard SANs. You wouldn't be able to do that with LE. Edit: I was under the impression you couldn't do multiple wildcard SANs in LE but according to some forum posts it's fully possible as long as validation passes.

gsich 9y ago
Besides having a fancy name in the URL bar I can't think of any.
- Symbiote 9y ago
  Using TLS on a server which doesn't have outbound/inbound access to the Internet/LetsEncrypt servers. Sharing a (wildcard) certificate between multiple servers.
  - gsich 9y ago
    Thats a distribution problem. You don't need to be accessible from the outside internet to use a LE certificate. You can request a cert from another one, then copy it. (Either manually or automatically, that is up to you)
comex 9y ago
You can definitely get certs from LetsEncrypt that have SANs for multiple unrelated domains. I haven’t tried out wildcard certificates at all yet, but I would be surprised if it didn’t allow combining those features…
- timlardner 9y ago
  I've got two wildcard domains that are completely unrelated from LetsEncrypt.

sillysaurus3 9y ago

This is a much bigger deal than people are giving it credit for. At any point in history, have CAs revoked certs solely to censor a target website? Maybe the answer is yes. I don't know. But this is a rude wake-up call for me and everyone else who tried to force the world into this shape. We've all been shouting "You have to use TLS! It's fundamental security 101. If you're not using https, your site is probably broken. And there's no reason not to do it, since it's so easy." Surprise: Now nobdoy trusts http, and those that control https can revoke their trust based on arbitrary human morals rather than solid technical reasons. I was a pentester for years and not once did anybody mention this threat anywhere. It's blindingly obvious in hindsight, but it was too easy not to think about it. Let's Encrypt is in the exact same position. Why do we trust them? Think about it -- they're under US jurisdiction and subject to US laws. The government could compel them to revoke certs. We're lucky that it's just a minor annoyance. Picture a world where no major browser renders http at all, and the only way to get a site online is to have a trusted cert. This is not far from reality: If the Magic Leap turns out not to be vaporware, they're going to be launching a DRM-powered internet that can't be adblocked. And that means we'll all be subject to government whims far more than we'd like to admit.

maxerickson 9y ago
All the various DNS alternatives people have pitched over the years pretty directly address the centralization issue you are getting at here. Often by casting themselves as decentralized. Really the issue is that decentralization isn't very compatible with convenience and people generally place a lot more value on convenience than things like Sci-Hub.
ams6110 9y ago
Self-signed certificates, trust on first use (or verify out of band) like SSH, works around most of this
- ethbro 9y ago
  Correct me if I'm wrong, but the signed server-identifying cert is swapped in TLS before the connection is encrypted, no? So it's not technically infeasible to have networking gear drop any connection which doesn't chain back to a government-approved root?

bdcravens 9y ago

If you're on AWS it's easy enough to just use their CA with ALB