5 ms·
Oh single points of failure, where art thou... I hope everyone realises that Let's Encrypt is by now an essential part of the Internet, somewhat like DNS is, j
by ivoras 6y ago
Oh single points of failure, where art thou...
I hope everyone realises that Let's Encrypt is by now an essential part of the Internet, somewhat like DNS is, just massively centralised.
- RL_Quine 6y agoThey aren't the only no-cost distributor, their downtime doesn't really matter so long as it's less than a month long. What exactly is the issue with centralization here?
- acct776 6y ago> They aren't the only no-cost distributor I couldn't name a second, which means they're probably not getting a huge %.
- cholmon 6y agoHow would Netlify feel about not being able to issue or renew any certs for any sites for a month? Plenty of platforms rely on LE exclusively for one-click/automatic HTTPS for their customers sites.
- Denvercoder9 6y agoLet's Encrypt isn't the only provider supporting ACME either. Sectigo (under the ZeroSSL name) is a notable alternative.
- mvolfik 6y agoThe thing is that we're not talking downtime here, but rather something in the CA compromised, which would mean that pretty much ANY website could be impersonated, as the attacker could issue a Let's Encrypt CA valid certificate for it. That is mitigated by invalidating this CA, but that also invalidates all legit certificates previously issued by them. So they need to reissue them all
- warkdarrior 6y agoLet's Encrypt publishes Certificate Transparency logs: https://letsencrypt.org/docs/ct-logs/ https://letsencrypt.org/docs/ct-logs/ You can both block certs that do not appear in the logs, and decide which certs not to trust ("everything after Friday the 13th at midnight is not trusted"), once you know the date/time of the intrusion.
- jaywalk 6y agoIf Let's Encrypt went away tomorrow, I'd Google "free SSL certificate" and find somebody else. Worst case, I'd either go back to the old way and buy a cheap certificate or go without SSL until a new free option comes along.
- notafraudster 6y agoHonest question (I know just enough about SSL to be dangerous): Does certificate pinning throw a wrench in this plan?
- rntksi 6y agoIf proper revoking procedures are being followed, no. You can start reading more info here: https://developer.mozilla.org/en-US/docs/Web/Security/Certificate_Transparency https://developer.mozilla.org/en-US/docs/Web/Security/Certif... (HPKP is considered obsolete, if by cert pinning you meant that. If you're confusing HSTS with HPKP, just know that HSTS makes it much harder to mistakenly access the site via http, while HPKP [now deprecated] is the practice of ensuring some hashes is found in the cert that the server sends to mitigate some attacks)
- NovemberWhiskey 6y agoAt this point, I don't think certificate pinning in the general internet/web environment is a thing.
- LinuxBender 6y agoAgreed. I MITM all my own traffic and I only have to exclude a handful of domains or A records on domains to not MITM.
- leesalminen 6y agoHonestly curious, why do you MITM all your own traffic? For detailed logging?
- toomuchtodo 6y agoA lesson in recognizing, supporting, and defending public goods.
- marcosdumay 6y agoThe TLS CA system is one of those places where a single failure point is absolutely better than distributed possibilities. That is the case because any failure anywhere compromises the entire system. Of course, the other failure points didn't completely go away yet. But I do expect their number to reduce a lot in the future.
- nodesocket 6y agoSounds like they have read-replicas, why can’t they fail over to a read replica as the new master?
- gregwebs 6y agoThis is why they created the ACME protocol. There are actually other providers of this protocol now. So there is a possible future that is much more like DNS.
- coding123 6y agoBut it's a single point of failure that has about 60 days to come back online (if all actors are working fairly normally) from a full crash.
- gerdesj 6y agoQuite. I'd hate to test it but 60 days is long enough to deploy a new CA and push the cert out to trust stores. In an emergency. It would take quite some coordination but I suspect the current pandemic might provide some models and examples as to the way to do things at scale with JiT decision making from wonks who normally drag feet by default.
- M2Ys4U 6y agoAgreed. I'd love to see, say, another charitable CA set up in a different jurisdiction[0] that can hold a similar reputation to the ISRG. [0] Probably somewhere in Europe, whether that's in the EU or elsewhere like Switzerland or the UK. What matters most is that it's somewhere with strong commitment to the Rule of Law and not beholden to the US.