4 ms·

LetsEncrypt is a hack to get HTTP encryption working without shelling out money for meaningless identity "verification". Code signing has nothing to do with enc

LetsEncrypt is a hack to get HTTP encryption working without shelling out money for meaningless identity "verification". Code signing has nothing to do with encryption, so having analogous CA for code would be entirely meaningless. What does code signing in Windows actually verify? That executable's author at some point paid money to some company that Microsoft deemed an "authority"? It's a rotten system. The whole CA pyramid is bullshit. What we really need is a way to know that executable notepad++2.0 is signed by the same person who signed notepad++1.0 already installed on your computer, and that it's the same person who controls notepad-plus-plus.org, and that this identity has existed for well over 10 years. This is legitimately useful info that would allow people to make more informed decisions about what to install. BTW, the part about historic record seems like one of the few good uses for blockchain technology.

smarx007 8y ago
No, it verifies that the certificate was issued to someone whose ID was checked. Money is paid for the covering the bureaucratic costs and keeping the records etc.
- gambler 8y ago
  Problem is, this assumes that all CAs and their resellers do that verification properly. https://security.googleblog.com/2015/03/maintaining-digital-certificate-security.html https://security.googleblog.com/2015/03/maintaining-digital-... https://arstechnica.com/information-technology/2017/11/evasive-code-signed-malware-flourished-before-stuxnet-and-still-does/ https://arstechnica.com/information-technology/2017/11/evasi... "The third key weakness in the code-signing ecosystem was the failure of certificate authorities to verify the identities of people applying for code-signing certificates. Twenty-seven certificates in the group of 111 misappropriated certificates that the researchers identified fell into this class. Twenty-two of the certificates were improperly issued as a result of identity theft of a legitimate company. In some cases, malicious actors impersonated legitimate companies, in some cases ones that had no involvement at all in publishing software. In the remaining five cases, the certificates were issued to fraudulent shell companies. "
theandrewbailey 8y ago
> LetsEncrypt is a hack to get HTTP encryption working without shelling out money for meaningless identity "verification". Have you used Let's Encrypt? It verifies that you own the domain in question. HTTPS requires that the server you're connecting to has been identified.
- ghostly_s 8y ago
  Verifying domain control =/= verifying identity.
- zamadatix 8y ago
  Operator != owner. I can break into your car, doesn't mean I can take it to the local DMV and get a new title with my name on it purely because I showed up in it.

smarx007 8y ago

No, it verifies that the certificate was issued to someone whose ID was checked. Money is paid for the covering the bureaucratic costs and keeping the records etc.

gambler 8y ago
Problem is, this assumes that all CAs and their resellers do that verification properly. https://security.googleblog.com/2015/03/maintaining-digital-certificate-security.html https://security.googleblog.com/2015/03/maintaining-digital-... https://arstechnica.com/information-technology/2017/11/evasive-code-signed-malware-flourished-before-stuxnet-and-still-does/ https://arstechnica.com/information-technology/2017/11/evasi... "The third key weakness in the code-signing ecosystem was the failure of certificate authorities to verify the identities of people applying for code-signing certificates. Twenty-seven certificates in the group of 111 misappropriated certificates that the researchers identified fell into this class. Twenty-two of the certificates were improperly issued as a result of identity theft of a legitimate company. In some cases, malicious actors impersonated legitimate companies, in some cases ones that had no involvement at all in publishing software. In the remaining five cases, the certificates were issued to fraudulent shell companies. "

theandrewbailey 8y ago

> LetsEncrypt is a hack to get HTTP encryption working without shelling out money for meaningless identity "verification". Have you used Let's Encrypt? It verifies that you own the domain in question. HTTPS requires that the server you're connecting to has been identified.

ghostly_s 8y ago
Verifying domain control =/= verifying identity.
zamadatix 8y ago
Operator != owner. I can break into your car, doesn't mean I can take it to the local DMV and get a new title with my name on it purely because I showed up in it.