3 ms·

This is really a drawback of the browser though, right? Let's Encrypt is about making traffic https not giving you strong verification of the other party. It's

This is really a drawback of the browser though, right? Let's Encrypt is about making traffic https not giving you strong verification of the other party. It's right there in the name! The browsers do show some things for better verified certificates e.g. "YOUR BANK LTD." on a banks cert, "Secure" on hacker news/My page secured with let's encrypt. So controlling traffic on the domain is really sufficient for the promise that LE is trying to make to you which is "When I accessed this domain, the entity that owns this key controlled the traffic. I don't really know anything about the entity." If you think that presents a vulnerability then it's because you're equating https with entity verification (and I don't blame you because the browsers have trained us to do this)

3pt14159 8y ago
Unfortunately the "YOUR BANK LTD" certs have a major drawback: No obscure / arbitrary subdomains. It's why Google doesn't use them. And I agree with your conclusion HTTPS is better than HTTP, but it doesn't mean we're talking with whom we think.
- adrianratnapala 8y ago
  > Unfortunately the "YOUR BANK LTD" certs have a major drawback: No obscure / arbitrary subdomains. Why is that a drawback from a user POV? I wish sites would try hard to keep there stuff in one part of the DNS name-tree if only to make uMatrix easier to use. I'm glad of anything that encourages them to do so.