4 ms·

“The masses” don’t deploy http servers. They don’t need to implement tls. The fact is that something struck a nerve and motivated the people who handle this to

“The masses” don’t deploy http servers. They don’t need to implement tls. The fact is that something struck a nerve and motivated the people who handle this to implement TLS. Whether that’s tech-minded understanding or consumer-fomented demand channeled through CTOs, I don’t really care. Let’s Encrypt founders didn’t sit down one day with a master business plan of getting rich off free certs. I wouldn’t be the least bit surprised if a high-level view showed Snowden having a lot to do with it.

TrueDuality 7y ago
LetsEncrypt was likely accelerated by the Snowden leaks, but the discussions around free community run CAs were around long before that precipitous event. For CloudFlare it was likely just an effective way to drive additional business to them while pursuing their business model. I don't think "the masses" fall into the equation at all and likely haven't even really noticed the change besides the "This site isn't safe" warnings that occasionally pop up.
- indigo945 7y ago
  If LetsEncrypt was accelerated by the Snowden leaks, that's a rather sad result. After all, it is absolutely trivial for a nation-state actor to generate SSL certificates for any domain they like, due to the broken state of global PKI. It is sufficient to gain access to any root certificate, or to know a person at a CA that can issue certificates, or to be able to manipulate the domain's nameserver, or to take over the server pointed to by the domain's A record, or to redirect traffic to that server to a middleman at the ISP level, in order to issue a perfectly valid, HSTS-accepted certificate. SSL helps against the skript kiddie at your local Starbucks, not against the NSA. (Of course, not being able to monitor and log all web traffic all the time must be a slight inconvenience, especially after the TLS 1.3 SAN changes. But we still shouldn't fool ourselves that just because we can't break it, the NSA can't either.)
  - gruez 7y ago
    >It is sufficient to gain access to any root certificate, or to know a person at a CA that can issue certificates, or to be able to manipulate the domain's nameserver, or to take over the server pointed to by the domain's A record, or to redirect traffic to that server to a middleman at the ISP level, in order to issue a perfectly valid, HSTS-accepted certificate. But every connection you're intercepting, you're providing airtight evidence that a misissuance occured (the certificate). It's only a matter of time until you're caught. With certificate transparency, it's broadcast to everyone in the world. So yes, nation states can bypass pki pretty easily, but it's only feasible for targeted attacks. That's better than the status quo of dragnet surveillance.
satori99 7y ago
> “The masses” don’t deploy HTTP servers. In a way they do... Every UPnP device is also a HTTP server (listening for SOAP requests), as are many other IoT devices. I have two light bulbs in my room that are both running HTTP servers. “The masses” are definitely deploying this type of HTTP server frequently
guggle 7y ago
> The fact is that something struck a nerve and motivated the people who handle this to implement TLS for the dot coms, let's not forget about Google's rank incentive. https://thenextweb.com/google/2015/12/17/unsecured-websites-are-about-to-get-hammered-in-googles-search-ranking/ https://thenextweb.com/google/2015/12/17/unsecured-websites-...

TrueDuality 7y ago

LetsEncrypt was likely accelerated by the Snowden leaks, but the discussions around free community run CAs were around long before that precipitous event. For CloudFlare it was likely just an effective way to drive additional business to them while pursuing their business model. I don't think "the masses" fall into the equation at all and likely haven't even really noticed the change besides the "This site isn't safe" warnings that occasionally pop up.

indigo945 7y ago
If LetsEncrypt was accelerated by the Snowden leaks, that's a rather sad result. After all, it is absolutely trivial for a nation-state actor to generate SSL certificates for any domain they like, due to the broken state of global PKI. It is sufficient to gain access to any root certificate, or to know a person at a CA that can issue certificates, or to be able to manipulate the domain's nameserver, or to take over the server pointed to by the domain's A record, or to redirect traffic to that server to a middleman at the ISP level, in order to issue a perfectly valid, HSTS-accepted certificate. SSL helps against the skript kiddie at your local Starbucks, not against the NSA. (Of course, not being able to monitor and log all web traffic all the time must be a slight inconvenience, especially after the TLS 1.3 SAN changes. But we still shouldn't fool ourselves that just because we can't break it, the NSA can't either.)
- gruez 7y ago
  >It is sufficient to gain access to any root certificate, or to know a person at a CA that can issue certificates, or to be able to manipulate the domain's nameserver, or to take over the server pointed to by the domain's A record, or to redirect traffic to that server to a middleman at the ISP level, in order to issue a perfectly valid, HSTS-accepted certificate. But every connection you're intercepting, you're providing airtight evidence that a misissuance occured (the certificate). It's only a matter of time until you're caught. With certificate transparency, it's broadcast to everyone in the world. So yes, nation states can bypass pki pretty easily, but it's only feasible for targeted attacks. That's better than the status quo of dragnet surveillance.

satori99 7y ago

> “The masses” don’t deploy HTTP servers. In a way they do... Every UPnP device is also a HTTP server (listening for SOAP requests), as are many other IoT devices. I have two light bulbs in my room that are both running HTTP servers. “The masses” are definitely deploying this type of HTTP server frequently

guggle 7y ago

> The fact is that something struck a nerve and motivated the people who handle this to implement TLS for the dot coms, let's not forget about Google's rank incentive. https://thenextweb.com/google/2015/12/17/unsecured-websites-are-about-to-get-hammered-in-googles-search-ranking/ https://thenextweb.com/google/2015/12/17/unsecured-websites-...