4 ms·
EU wants to be able to decrypt your private communications.
by zoobab 4y ago
EU wants to be able to decrypt your private communications.
- thefounder 4y agoHow is that? Are private CAs to be trusted more than gov issued CAs? The whole CA store idea seems a bit dated to me.
- pannSun 4y agoCAs that you choose to trust are more trustworthy than those you are compelled to trust. See RobotToaster's comment: https://news.ycombinator.com/item?id=33967192 https://news.ycombinator.com/item?id=33967192
- thefounder 4y agoIn practice users don't really choose which CA to trust. That choice is made by app and/or OS developers but I understand your point. That EU directive seems to force developers to accept EU's CA which is wrong of course. Nevertheless this CA store distribution put us in this censorship situation. I think it should be moved further towards the service provider in a similar way webauthn works. The 3rd party CA makes the whole process vulnerable to rough CA providers or mandatory CA stores. Let's stop trusting 3rd parties with our security.
- ko27 4y agoThey can not, the same way Lets Encrypt can not decrypt your private communications.
- vorpalhex 4y agoActually LE could. They would re-issue a new valid cert for your domain without removing the old one. That would enable a MITM attack.
- geocar 4y agoOne could either spam DNS responses at the LE clients or push bogus BGP routes towards LE, and quite probably other things. And you don’t even need LE’s help to do any of this.
- lathiat 4y agoWhile these kinds of attacks are certainly possible, Let's Encrypt is not blind to them and has mitigations specifically for BGP hijacking for example: https://letsencrypt.org/2020/02/19/multi-perspective-validation.html https://letsencrypt.org/2020/02/19/multi-perspective-validat...