6 ms·
> With the advent of ACME-based certificate authorities such as Let’s Encrypt, obtaining certificates is not at all hard for someone able to intercept and respo
by agwa 3y ago
> With the advent of ACME-based certificate authorities such as Let’s Encrypt, obtaining certificates is not at all hard for someone able to intercept and respond to traffic that is sent to your server, and in this case that’s exactly what happened.
This was easy even before ACME/Let's Encrypt, as several CAs would validate domains using HTTP-based methods similar to ACME's HTTP challenge. These methods were usually less secure than ACME, as CAs would send HTTP requests to non-privileged ports, or use URLs that weren't under .well-known, or allow a validation of www.example.com to be used to issue certificates for example.com.
ACME did not make anything less secure or more convenient for attackers. Rather, ACME raised the bar.
- kbenson 3y agoWere those CAs trusted by major operating systems and browsers?
- dijit 3y agoI don't remember putting anything in my web address for domain validated TLS, i could be mistaken. I have definitely seen email as part of the verification chain and alteration of DNS records: both of which would be hard(er) than intercepting a http request on an infrastructure provider of the host providing the website. Of course; that would mean the provider who has your DNS could do it, but those are often separate entities and they would have to collude