3 ms·
Indeed. Let’s Encrypt would happily issue a cert to scams4u.com provided only proof that the person making the request has control over the domain (that really
by gaius 8y ago
Indeed. Let’s Encrypt would happily issue a cert to scams4u.com provided only proof that the person making the request has control over the domain (that really is all they check). “Secure” implies far, far more than merely “encrypted”. The biggest security problems are behind the web server, not between you and it!
- mort96 8y agoI know it probably wasn't your intention to single out Let's Encrypt, but it's probably worth mentioning that almost any registrar, not just LE, would issue a certificate for a scam site, provided they can prove they own the domain.
- gaius 8y agoIt wasn’t always like that. In the 90s I remember to get a cert we had to pay a fee for a background check (Dun & Bradstreet, Companies House, etc). Obviously not foolproof but a massively greater assurance than anyone gets today.
- tazard 8y agoWould it be better if your phished credentials were MITM'd by a third party scammer due to being sent in clear text instead of going directly to the original scammers? I for one don't think so.
- gaius 8y agoOf all the recent high profile breaches, none would have been mitigated by HTTPS, or occurred anyway. Let me clarify that I don’t object to encryption - I object to telling the user “this site is secure” when there is no way to know that