3 ms·

As I stated I will agree to disagree. I have my own views based on my own experiences as you have yours. This ain’t new to me. Security is always number one. I

As I stated I will agree to disagree. I have my own views based on my own experiences as you have yours. This ain’t new to me. Security is always number one. I wasn’t trying to pitch “these are good arguments”. I am expressing my own, whether right or wrong, secure or insecure. No successful hacking attempts so far on my watch. Everyone feels so safe using HTTPS but when it cracks we are going to be screwed. let’s not forget about HeartBleed and all the others. What’s stops a corporation/CA from revoking a certificate because you threaten their business? It’s moot. I wouldn’t touch let’s encrypt with a barge poll. If I want a SSL i’d rather fork out in a paid cert as at least there is insurance behind. When google can create their own CA authority how is that secure? Look at google certs, they’ve planted their own global root cert in your OS without you even approving it. HTTPS is lazy, might be easy but poor mans security. But to end this debate some is better then none.

eropple 7y ago
While HTTPS has problems, you have circumscribed a set of objections (ranging from HTTPS being compromised to "oh I won't touch Let's Encrypt") that, if we're being frank, seems to exist to give you something to object about, not to actually have a meaningful and good-faith conversation. One "agrees to disagree" on the fairly basic security concepts under discussion when they know they're just being contrary. Not everyone uses OpenSSL, but within epsilon of everyone has used a nasty WAP that injects shit into pages. That is what, and only what, Let's Encrypt exists to solve--it ignores the ever-more-foolish conflation of encryption and identity and explicitly only provides the thinnest (domain-level) identity while providing good to excellent security against drive-by attackers.
- doublerabbit 7y ago
  Then why are we not fixing the problems that exist instead of plastering the hole within HTTPS? Or is that the best we’ve ever going to have? Corporations have ruined the internet yet we want to support them more. I refuse to gander anything created by the Linux Foundation. I dislike Linux. Would be my first point. Once upon a time I never held that view, but I do now. I am happy to have a good-faith discussion but as I am currently on limited time. My objections on the whole matter may sound cynical but are still valid. We are ignorant towards security and a big hack is bound to happen sooner or later. All battle grounds have weaknesses. I am on my mobile nor do I have the time right now however if i was however at my workstation then I would put concise in to my statements.
  - eropple 7y ago
    "We shouldn't use the only thing we have, we should hold out for a hypothetical and highly-coordinated future that I refuse to substantiate." This is not "cynicism". This is not good-faith discussion.
MaxBarraclough 7y ago
> This ain’t new to me. Respectfully, you were mistaken on several points of fact. It's quite clear that some of this stuff is new to you. > No successful hacking attempts so far on my watch. HTTPS doesn't protect a website against intruders, nor is it meant to. That's a whole different conversation. > Everyone feels so safe using HTTPS but when it cracks we are going to be screwed Is your issue with diversity of implementations, or with diversity of underlying algorithms? The cyber-security community has collectively agreed that it's best to maintain relatively few cryptography codebases well, rather than maintain many of them. So yes, if there are flaws in libraries like OpenSSL, that's a big problem, but experience shows that this approach is far better than using half-baked crypto solutions. The worst security of all is where the crypto is provided by a half-baked 'custom' solution thrown together by well-meaning amateurs, never subjected to critical review by serious cryptographers. Ideally I'd like to see things go even further in the current direction: we should be using formally verified implementations of TLS. That would close the door on issues like HeartBleed. The only issues remaining would be side-channel attacks, and advances in cryptography that defeat the underlying cryptographic approach. > What’s stops a corporation/CA from revoking a certificate because you threaten their business? Has this ever happened? If it did, I'd report them to the CA/Browser Forum, and get a replacement cert from a different CA. > I wouldn’t touch let’s encrypt with a barge poll. If I want a SSL i’d rather fork out in a paid cert as at least there is insurance behind. I agree that you need to be able to trust your CA, especially as the web moves toward short-lived certs. If your CA has an issue, your whole site disappears from the web. So far, I think all the major CAs have a pretty good reputation when it comes to reliability, but I'm not very experienced in that area. > When google can create their own CA authority how is that secure? Look at google certs, they’ve planted their own global root cert in your OS without you even approving it. I'm afraid I don't know what you're referring to. Does Chrome install root certs into Windows when installed? If so, I agree that Google shouldn't be doing that. As for Google being a CA: I'm not too worried about that. When it comes to the imperfections of the CA system, there are worse issues than Google being on the list. > HTTPS is lazy, might be easy but poor mans security. What's the alternative? A web-of-trust approach would greatly complicate things, compared to the current approach using CAs. I don't know what you mean by 'easy'. What do you have in mind? Again, whatever the solution, the website's own code cannot secure the channel. Right now, HTTPS is the only game in town, and it works pretty well.

eropple 7y ago

While HTTPS has problems, you have circumscribed a set of objections (ranging from HTTPS being compromised to "oh I won't touch Let's Encrypt") that, if we're being frank, seems to exist to give you something to object about, not to actually have a meaningful and good-faith conversation. One "agrees to disagree" on the fairly basic security concepts under discussion when they know they're just being contrary. Not everyone uses OpenSSL, but within epsilon of everyone has used a nasty WAP that injects shit into pages. That is what, and only what, Let's Encrypt exists to solve--it ignores the ever-more-foolish conflation of encryption and identity and explicitly only provides the thinnest (domain-level) identity while providing good to excellent security against drive-by attackers.

doublerabbit 7y ago
Then why are we not fixing the problems that exist instead of plastering the hole within HTTPS? Or is that the best we’ve ever going to have? Corporations have ruined the internet yet we want to support them more. I refuse to gander anything created by the Linux Foundation. I dislike Linux. Would be my first point. Once upon a time I never held that view, but I do now. I am happy to have a good-faith discussion but as I am currently on limited time. My objections on the whole matter may sound cynical but are still valid. We are ignorant towards security and a big hack is bound to happen sooner or later. All battle grounds have weaknesses. I am on my mobile nor do I have the time right now however if i was however at my workstation then I would put concise in to my statements.
- eropple 7y ago
  "We shouldn't use the only thing we have, we should hold out for a hypothetical and highly-coordinated future that I refuse to substantiate." This is not "cynicism". This is not good-faith discussion.

MaxBarraclough 7y ago

> This ain’t new to me. Respectfully, you were mistaken on several points of fact. It's quite clear that some of this stuff is new to you. > No successful hacking attempts so far on my watch. HTTPS doesn't protect a website against intruders, nor is it meant to. That's a whole different conversation. > Everyone feels so safe using HTTPS but when it cracks we are going to be screwed Is your issue with diversity of implementations, or with diversity of underlying algorithms? The cyber-security community has collectively agreed that it's best to maintain relatively few cryptography codebases well, rather than maintain many of them. So yes, if there are flaws in libraries like OpenSSL, that's a big problem, but experience shows that this approach is far better than using half-baked crypto solutions. The worst security of all is where the crypto is provided by a half-baked 'custom' solution thrown together by well-meaning amateurs, never subjected to critical review by serious cryptographers. Ideally I'd like to see things go even further in the current direction: we should be using formally verified implementations of TLS. That would close the door on issues like HeartBleed. The only issues remaining would be side-channel attacks, and advances in cryptography that defeat the underlying cryptographic approach. > What’s stops a corporation/CA from revoking a certificate because you threaten their business? Has this ever happened? If it did, I'd report them to the CA/Browser Forum, and get a replacement cert from a different CA. > I wouldn’t touch let’s encrypt with a barge poll. If I want a SSL i’d rather fork out in a paid cert as at least there is insurance behind. I agree that you need to be able to trust your CA, especially as the web moves toward short-lived certs. If your CA has an issue, your whole site disappears from the web. So far, I think all the major CAs have a pretty good reputation when it comes to reliability, but I'm not very experienced in that area. > When google can create their own CA authority how is that secure? Look at google certs, they’ve planted their own global root cert in your OS without you even approving it. I'm afraid I don't know what you're referring to. Does Chrome install root certs into Windows when installed? If so, I agree that Google shouldn't be doing that. As for Google being a CA: I'm not too worried about that. When it comes to the imperfections of the CA system, there are worse issues than Google being on the list. > HTTPS is lazy, might be easy but poor mans security. What's the alternative? A web-of-trust approach would greatly complicate things, compared to the current approach using CAs. I don't know what you mean by 'easy'. What do you have in mind? Again, whatever the solution, the website's own code cannot secure the channel. Right now, HTTPS is the only game in town, and it works pretty well.