4 ms·

There is a list of all affected certificates posted under https://letsencrypt.org/caaproblem/ https://letsencrypt.org/caaproblem/ - and it looks like they are a

by ge0rg 7y ago

There is a list of all affected certificates posted under https://letsencrypt.org/caaproblem/ https://letsencrypt.org/caaproblem/ - and it looks like they are also leaking the account IDs from the list, so now you can map different domains/certificates to the account that got them issued.

tialaramex 7y ago
Yeah, it does seem like it'd have been sensible not to list the account ID in this file. It's convenient if you know your account ID and want to pull out just your certs, but for most people this associates all their certificates together. If you own both https://www.happy-rainbow-nursery.example/ https://www.happy-rainbow-nursery.example/ and https://hardcore.bdsm-videos.example/ https://hardcore.bdsm-videos.example/ you probably go to some lengths to avoid visitors realising the connection. Nothing you're doing is illegal or even unethical - but it's obviously going to cause uncomfortable conversations so why not avoid that altogether. Let's Encrypt aren't doing you a favour if tomorrow a mom at nursery says now she knows why you sound so much like Masked Mistress Martha...
- djsumdog 7y ago
  Yea, this is really bad. I've done some searching of the data. Sometimes it doesn't matter. It looks like whoever is currently running gab.com is probably a big consulting company with like 100 other clients, so there's no big relation there. But if you run a small personal blog and use the same e-mail address for maybe more controversial sites that are hosted on different IPs, now you could get doxed. I'm guessing customer IDs are associated with e-mail addresses? This seems like a good case of using different e-mails for ever cert. There are open source tools like anonaddy.com you can host yourself or buy from them (they have a decent free tier). I feel like this list seriously needs to be pulled. There is some serious lack of oversight here.
  - pfg 7y ago
    > I'm guessing customer IDs are associated with e-mail addresses? They are (on Let's Encrypt's end), if an email address was provided. It's a 1:n relation, the same email may be used for any number of ACME accounts. Roughly speaking, for most clients, the ACME account maps to a specific ACME client on a specific host. If you run three servers with separate ACME clients, you're probably using three ACME accounts (even if you're using the same email and issuing certificates for the same domain). Large or custom implementations may reuse the same ACME account across many servers and domains. (Issuance would typically be centralized and operated as a separate system in these scenarios.)

by ge0rg 7y ago

tialaramex 7y ago

Yeah, it does seem like it'd have been sensible not to list the account ID in this file. It's convenient if you know your account ID and want to pull out just your certs, but for most people this associates all their certificates together. If you own both https://www.happy-rainbow-nursery.example/ https://www.happy-rainbow-nursery.example/ and https://hardcore.bdsm-videos.example/ https://hardcore.bdsm-videos.example/ you probably go to some lengths to avoid visitors realising the connection. Nothing you're doing is illegal or even unethical - but it's obviously going to cause uncomfortable conversations so why not avoid that altogether. Let's Encrypt aren't doing you a favour if tomorrow a mom at nursery says now she knows why you sound so much like Masked Mistress Martha...

djsumdog 7y ago
Yea, this is really bad. I've done some searching of the data. Sometimes it doesn't matter. It looks like whoever is currently running gab.com is probably a big consulting company with like 100 other clients, so there's no big relation there. But if you run a small personal blog and use the same e-mail address for maybe more controversial sites that are hosted on different IPs, now you could get doxed. I'm guessing customer IDs are associated with e-mail addresses? This seems like a good case of using different e-mails for ever cert. There are open source tools like anonaddy.com you can host yourself or buy from them (they have a decent free tier). I feel like this list seriously needs to be pulled. There is some serious lack of oversight here.
- pfg 7y ago
  > I'm guessing customer IDs are associated with e-mail addresses? They are (on Let's Encrypt's end), if an email address was provided. It's a 1:n relation, the same email may be used for any number of ACME accounts. Roughly speaking, for most clients, the ACME account maps to a specific ACME client on a specific host. If you run three servers with separate ACME clients, you're probably using three ACME accounts (even if you're using the same email and issuing certificates for the same domain). Large or custom implementations may reuse the same ACME account across many servers and domains. (Issuance would typically be centralized and operated as a separate system in these scenarios.)