3 ms·

Not really considering you have to buy certs if you want people to use your site, it doesn't have any sensitive data on it (not even source code or binaries), a

by anaphor 13y ago

Not really considering you have to buy certs if you want people to use your site, it doesn't have any sensitive data on it (not even source code or binaries), and they haven't finished cleaning it up to their standards yet.

phlo 13y ago
StartCom/StartSSL [1] and, to my knowledge, Comodo [2] do offer free (and widely supported) SSL certs. Charges may apply to revoke certificates if a private key is leaked ($25 at StartSSL, IIRC). As for why SSL should be used everywhere: It improves security and makes eavesdropping more expensive. For the first point, see the BEAST and CRIME attacks. On vulnerable systems, a single unencrypted connection may be used to reveal data from other, encrypted streams. As for the second: if only sensitive data is encrypted, all encrypted streams automatically become "interesting" to a potential eavesdropper. If, however, everything is encrypted, all streams become equal again. The cost of storing all communications becomes much higher, and the ratio of cost and reward of decrypting a single captured stream worsens (as you may either reveal sensitive or non-sensitive data). [1] https://www.startssl.com/ https://www.startssl.com/ [2] http://www.instantssl.com/ssl-certificate-products/free-ssl-certificate.html http://www.instantssl.com/ssl-certificate-products/free-ssl-...
- watwut 13y ago
  If you have to pay for revocation, then it is not free certificate. It is just certificate with fees postponed. It is not the same thing. Not sure how you, but when I buy things I do not consider only initial price, but also additional fees. If we want SSL used everywhere, browsers need accept self signed certificates in less obtuse way or there need to be other way to get really free ones.
  - watwut 13y ago
    Why was this downvoted?
- Jare 13y ago
  I bet StartSSL would happily (and publicly) waive any revoke fees to FOSS SSL software projects.
  - M2Ys4U 13y ago
    And you would lose your money.
repsilat 13y ago
>(not even source code or binaries The real see site doesn't have those things, but a MITM'd unsecured version might.

by anaphor 13y ago

phlo 13y ago

StartCom/StartSSL [1] and, to my knowledge, Comodo [2] do offer free (and widely supported) SSL certs. Charges may apply to revoke certificates if a private key is leaked ($25 at StartSSL, IIRC). As for why SSL should be used everywhere: It improves security and makes eavesdropping more expensive. For the first point, see the BEAST and CRIME attacks. On vulnerable systems, a single unencrypted connection may be used to reveal data from other, encrypted streams. As for the second: if only sensitive data is encrypted, all encrypted streams automatically become "interesting" to a potential eavesdropper. If, however, everything is encrypted, all streams become equal again. The cost of storing all communications becomes much higher, and the ratio of cost and reward of decrypting a single captured stream worsens (as you may either reveal sensitive or non-sensitive data). [1] https://www.startssl.com/ https://www.startssl.com/ [2] http://www.instantssl.com/ssl-certificate-products/free-ssl-certificate.html http://www.instantssl.com/ssl-certificate-products/free-ssl-...

watwut 13y ago
If you have to pay for revocation, then it is not free certificate. It is just certificate with fees postponed. It is not the same thing. Not sure how you, but when I buy things I do not consider only initial price, but also additional fees. If we want SSL used everywhere, browsers need accept self signed certificates in less obtuse way or there need to be other way to get really free ones.
- watwut 13y ago
  Why was this downvoted?
Jare 13y ago
I bet StartSSL would happily (and publicly) waive any revoke fees to FOSS SSL software projects.
- M2Ys4U 13y ago
  And you would lose your money.

repsilat 13y ago

>(not even source code or binaries The real see site doesn't have those things, but a MITM'd unsecured version might.