4 ms·

They will not stop Letsencrypt abroad, it is clearly an asset for the US gov, the same way that Cloudflare is a worldwide MITM, it would be absurd to shut it do

by rvnx 1y ago

They will not stop Letsencrypt abroad, it is clearly an asset for the US gov, the same way that Cloudflare is a worldwide MITM, it would be absurd to shut it down. If you are a letsencrypt user, then it is nearly impossible to see (even with CT logs) that there was a malicious interception. From a website operator it looks like a pretty standard renewal as Letsencrypt has a short validity duration anyway. Add on top of that in the US they have access to easy and non-BGP entry points to reroute traffic (Google DNS, Cloudflare DNS). They can intercept in practice all Cloudflare and all Letsencrypt sites (except the Letsencrypt they also need cooperation of a friendly DNS and have a very theoretical little risk to get caught in CT logs). Big sites like Meta or Google or Amazon already have to cooperate and intercept internally so in practice almost all western internet is interceptable rather easily. There is zero world where US gov would want to stop that. The tech guys working for the NSA are from being idiots, and it would be insulting to even consider that. They would fight to protect Letsencrypt

actionfromafar 1y ago
Good thing they never do any absurd things nowadays.
hdgvhicv 1y ago
> They will not stop Letsencrypt abroad, it is clearly an asset for the US gov, the same way that Cloudflare is a worldwide MITM, it would be absurd to shut it down. That’s does not mean they wouldn’t shut it down.
ayende 1y ago
Sure you can, you know what your public key _should_ look like
- crtasm 1y ago
  Excatly. There must be tools to automate checking newly issued certificates against your own copy, could anyone recommend a self-hosted one?
  - throw0101c 1y ago
    E.g., * https://github.com/SSLMate/certspotter https://github.com/SSLMate/certspotter * https://certificate.transparency.dev/monitors/ https://certificate.transparency.dev/monitors/
- rvnx 1y ago
  Very unlikely in the real world. Maybe <5% of devops are checking in reality (and this is very generous); even if they watch it is very difficult to spot since the CA is the same, and short-lived certificates (so very normal that they renew). crt.sh is even answering 502 Bad Gateway, though it's supposed to be the most used tool to check CT logs in the world. So maybe, true for few paranoid geeks who usually don't have any information of interest anyway, but not for the 99% others. The big websites are openly sharing data to govs, so they are backdoored by definition, and they don't need to justify anything.
  - ayende 1y ago
    If you are checking the cert logs, it is a very tiny bit to validate the key as well. If you aren't checking... well, that isn't a concern anyway, now is it? And the whole _point_ of the cert transparency log is that it only take _one_ such instance to ruin the credibility of a CA. The fact that you do that in the public, and that it is _forever_, make it very hard to do in the shadows.
  - ayende 1y ago
    FWIW, I once got a cease and desist letter because "company-xyz" found that we were using a subdomain "company-xyz.customers.our-service.com". They discovered that because they were monitoring the CT logs. And they were concerned about trademark issues. It ended up being one of the teams in "company-xyz" that had opened an account (under the company name, of course). But that is just a small note that people _are_ monitoring those.

by rvnx 1y ago

actionfromafar 1y ago

Good thing they never do any absurd things nowadays.

hdgvhicv 1y ago

> They will not stop Letsencrypt abroad, it is clearly an asset for the US gov, the same way that Cloudflare is a worldwide MITM, it would be absurd to shut it down. That’s does not mean they wouldn’t shut it down.

ayende 1y ago

Sure you can, you know what your public key _should_ look like

crtasm 1y ago
Excatly. There must be tools to automate checking newly issued certificates against your own copy, could anyone recommend a self-hosted one?
- throw0101c 1y ago
  E.g., * https://github.com/SSLMate/certspotter https://github.com/SSLMate/certspotter * https://certificate.transparency.dev/monitors/ https://certificate.transparency.dev/monitors/
rvnx 1y ago
Very unlikely in the real world. Maybe <5% of devops are checking in reality (and this is very generous); even if they watch it is very difficult to spot since the CA is the same, and short-lived certificates (so very normal that they renew). crt.sh is even answering 502 Bad Gateway, though it's supposed to be the most used tool to check CT logs in the world. So maybe, true for few paranoid geeks who usually don't have any information of interest anyway, but not for the 99% others. The big websites are openly sharing data to govs, so they are backdoored by definition, and they don't need to justify anything.
- ayende 1y ago
  If you are checking the cert logs, it is a very tiny bit to validate the key as well. If you aren't checking... well, that isn't a concern anyway, now is it? And the whole _point_ of the cert transparency log is that it only take _one_ such instance to ruin the credibility of a CA. The fact that you do that in the public, and that it is _forever_, make it very hard to do in the shadows.
- ayende 1y ago
  FWIW, I once got a cease and desist letter because "company-xyz" found that we were using a subdomain "company-xyz.customers.our-service.com". They discovered that because they were monitoring the CT logs. And they were concerned about trademark issues. It ended up being one of the teams in "company-xyz" that had opened an account (under the company name, of course). But that is just a small note that people _are_ monitoring those.