5 ms·

Now we have letsencrypt.org

metildaa 8y ago
And more and more normal people are on Signal & Riot. Hopefully Briar and Mastodon continue to improve, Briar for metadata free chats would be a great thing to normalize.
- mycall 8y ago
  Do both signal and riot work on matrix.org?
  - int_19h 8y ago
    Riot is a Matrix client. Signal is not.
buboard 8y ago
how long until we find out something terrible about it?
- schoen 8y ago
  (I work on Let's Encrypt.) Let's Encrypt doesn't ever possess your private keys, doesn't know who connects to your site if you use OCSP stapling, and doesn't control what kind of cryptography you use when negotiating TLS sessions with your site visitors. Let's Encrypt also doesn't need any contact information from you when you obtain a certificate. Let's Encrypt certificates aren't trusted by Chrome without a proof of inclusion in public Certificate Transparency logs, so all issued certificates have to be disclosed. As I've said in a number of HN comments, the people working on Let's Encrypt generally still think that the CA system is too powerful, and are happy for your suggestions about how about it can made more transparent and less powerful.
  - buboard 8y ago
    > can made more transparent and less powerful Looking forward to it. I imagine, when SSL becomes mandatory by browsers, it can be used for censorship.
    - schoen 8y ago
      That's definitely a serious and important problem.
    - brokenmachine 8y ago
      >when SSL becomes mandatory by browsers, it can be used for censorship. Can someone explain how that works? I thought SSL would make censorship less practical.
      - chasil 8y ago
        Like this: https://nakedsecurity.sophos.com/2013/01/08/the-turktrust-ssl-certificate-fiasco-what-happened-and-what-happens-next/ https://nakedsecurity.sophos.com/2013/01/08/the-turktrust-ss... Anything that gets into your bundle establishes incredible power over you.
      - schoen 8y ago
        I think what buboard is talking about is that CAs can revoke certificates that they've issued, and can refuse to issue certificates to particular sites. Someone might pressure CAs to do this for a content censorship purpose, much in the way that people pressure other kinds of intermediaries and technical infrastructure providers when they find some online site or content or activity objectionable.
      - crankylinuxuser 8y ago
        SSL depends on national agencies and orgs overseen by national agencies. If SSL is required, then whoever controls those agencies controls what's seen online. I already cannot easily add a root CA for .onion addresses and then make my own certs there, without browsers screaming bloody murder. I already cannot bypass cert errors for certain types of cert fails. Tor onion sites, which are end to end encrypted, are considered "insecure" because we plebes cannot buy a "proper" EV ssl cert, like Facebook did. Enforcement of SSL is just another way of controlling the user in name of "stupidity". Sure, the dumb click-anything users win, but anyone tech-savy loses freedoms.

And more and more normal people are on Signal & Riot. Hopefully Briar and Mastodon continue to improve, Briar for metadata free chats would be a great thing to normalize.

mycall 8y ago
Do both signal and riot work on matrix.org?
- int_19h 8y ago
  Riot is a Matrix client. Signal is not.

buboard 8y ago

how long until we find out something terrible about it?

schoen 8y ago
(I work on Let's Encrypt.) Let's Encrypt doesn't ever possess your private keys, doesn't know who connects to your site if you use OCSP stapling, and doesn't control what kind of cryptography you use when negotiating TLS sessions with your site visitors. Let's Encrypt also doesn't need any contact information from you when you obtain a certificate. Let's Encrypt certificates aren't trusted by Chrome without a proof of inclusion in public Certificate Transparency logs, so all issued certificates have to be disclosed. As I've said in a number of HN comments, the people working on Let's Encrypt generally still think that the CA system is too powerful, and are happy for your suggestions about how about it can made more transparent and less powerful.
- buboard 8y ago
  > can made more transparent and less powerful Looking forward to it. I imagine, when SSL becomes mandatory by browsers, it can be used for censorship.
  - schoen 8y ago
    That's definitely a serious and important problem.
  - brokenmachine 8y ago
    >when SSL becomes mandatory by browsers, it can be used for censorship. Can someone explain how that works? I thought SSL would make censorship less practical.
    - chasil 8y ago
      Like this: https://nakedsecurity.sophos.com/2013/01/08/the-turktrust-ssl-certificate-fiasco-what-happened-and-what-happens-next/ https://nakedsecurity.sophos.com/2013/01/08/the-turktrust-ss... Anything that gets into your bundle establishes incredible power over you.
    - schoen 8y ago
      I think what buboard is talking about is that CAs can revoke certificates that they've issued, and can refuse to issue certificates to particular sites. Someone might pressure CAs to do this for a content censorship purpose, much in the way that people pressure other kinds of intermediaries and technical infrastructure providers when they find some online site or content or activity objectionable.
    - crankylinuxuser 8y ago
      SSL depends on national agencies and orgs overseen by national agencies. If SSL is required, then whoever controls those agencies controls what's seen online. I already cannot easily add a root CA for .onion addresses and then make my own certs there, without browsers screaming bloody murder. I already cannot bypass cert errors for certain types of cert fails. Tor onion sites, which are end to end encrypted, are considered "insecure" because we plebes cannot buy a "proper" EV ssl cert, like Facebook did. Enforcement of SSL is just another way of controlling the user in name of "stupidity". Sure, the dumb click-anything users win, but anyone tech-savy loses freedoms.