3 ms·

Certificates are not expensive, they can be picked up for $5.

rurban 12y ago
Why should I pay a not-trustworthy company, when I can get one for free, from a widely respected and completely open sourced and community managed authority?
- abritishguy 12y ago
  "not-trustworthy" The process of obtaining an SSL certificate does not involve divulging your private key to the CA so what are you trusting them with? In reality you are trusting them not to sign certificates for sites not owned or administered by the person requesting it, they could (in theory) do this whether you got your certificate from them or not. In practice they cannot do this on a widespread scale without it being detected (e.g. Chrome sends info to Google if a certificate for a google domain is valid but not from the Google Internet Authority) and as soon as that happens then they lose their business (as is what happened to a CA that got hacked).
  - pgeorgi 12y ago
    It's the same kind of non-trust you (and others) assert over CAcert. See how well that model worked with Comodo and TurkTrust - both of which are still in business and in default CA lists, which is counter to your assertion that careful CA operation makes business sense. Unfortunately there's no will with browser vendors to _really_ improve matters (maybe TACK?), so something like CAcert is great should it get implemented (providing some heat to CA providers) and even when not (by showing the browser vendors' hypocrisy).
Karunamon 12y ago
Where would this be? And do they attempt to charge money on things that really don't need it? I.e. rekeys and renewals? What about wildcard domains? The same damn cert with a *. instead of a domain. shouldn't cost 10x more.
- abritishguy 12y ago
  I sell certificates: https://www.volcanicpixels.com/ssl/ https://www.volcanicpixels.com/ssl/ You can get the same certificates for much cheaper here: https://www.thesslstore.com/ https://www.thesslstore.com/ The certificates are absolutely identical, my customers use my site because it is well designed and easy to use and I do everything I can to provide great support, but if you know exactly what you are doing then I would recommend getting them directly from thesslstore - unless you have a desire to help pay for my uni education ;)
  - Karunamon 12y ago
    Thanks for pointing it out to me, but there are still some big failures there. First, the site appears broken. The "Purchase SSL" link on the front page goes to a 404. Second, the absolute cheapest certificate I could find anywhere was Certum's BasicID which costs $9.95 for one year. Third, the dark pattern of presenting a lower price up front ($8), but then you find that this only applies if you spring for more than one year. Misleading and weak. Finally, A wildcard certificate from the same company appears to cost $65.83/yr, (which goes up to $79.00 once you click on the link and realize that was the three year price.) Not going to lie, this website leaves me feeling very skewed out, and still costs too much for what you're getting anyways.
    - abritishguy 12y ago
      Sorry, I haven't looked at the site in a while and it has changed a lot. Wildcard certificates are rarely economical compared with just buying individual certs for the subdomains. > the dark pattern of presenting a lower price up front ($8), but then you find that this only applies if you spring for more than one year. Misleading and weak. Absolutely agree! If you send me an email then I'll make you a coupon to get a certificate for £5 (just over cost price) on my site: https://www.volcanicpixels.com/ssl/ https://www.volcanicpixels.com/ssl/ (which is open source: https://github.com/volcanicpixels/volcanicpixels/ https://github.com/volcanicpixels/volcanicpixels/)
      - 12y ago
nomailing 12y ago
5$ is expensive. Don't you know that there are other countries in the world and that the Internet is not only used by the US. There are also other age groups. If a 10 year old boy has a hobby website 5$ might be a price which is unacceptable. what would you say if I as a billionaire tell you that cars for less than 50 000 $ are not needed because all Ferraris are not expensive. So please don't use your subjective experience as an argument against cheap security solutions. They have a point to exist. Nobody should have the right to set the lower limit of how much you have to pay to secure your website. Commericial CAs cannot guarantee the security of your favorite site as we all learned from the heartbleed bug. So there is nit argument to favor them and block community solutions.
- abritishguy 12y ago
  I'm not American, so yes I am well aware. >If a 10 year old boy has a hobby website 5$ might be a price which is unacceptable. Why would this site need SSL?
  - aragot 12y ago
    Because he has users and he wants to keep their private info under encrypted channels? Hobby sites quickly become apps (even as small as phpBB) and it would be good if we SSL'd everything.
- lawnchair_larry 12y ago
  http://en.wikipedia.org/wiki/Reductio_ad_absurdum http://en.wikipedia.org/wiki/Reductio_ad_absurdum A 10 year old with a hobby site in a third world country doesn't need a $5 certificate. Neither does a rich 10 year old with a hobby site for that matter, but he can purchase one if he wants.
quasque 12y ago
They can even be picked up for free. At least one commercial CA issues free certificates as a matter of routine and (unlike CAcert) has its root certificate in all major OSes and browsers. Alternatively, if you already have a paid cert then some providers offer a free cert via 'competitive upgrade' programmes, if you switch to them (rather unethically, this also used to work to freely upgrade short-term trial certificates to full ones).
- abritishguy 12y ago
  Startcom charge for revocations though, which IMO is a very bad thing.
  - quasque 12y ago
    They do, but I'm not convinced that it matters - I'd be very surprised if there's any overlap between websites that use the free StartSSL cert, and websites that are worth the effort of hijacking the cert and MITMing.

Why should I pay a not-trustworthy company, when I can get one for free, from a widely respected and completely open sourced and community managed authority?

abritishguy 12y ago
"not-trustworthy" The process of obtaining an SSL certificate does not involve divulging your private key to the CA so what are you trusting them with? In reality you are trusting them not to sign certificates for sites not owned or administered by the person requesting it, they could (in theory) do this whether you got your certificate from them or not. In practice they cannot do this on a widespread scale without it being detected (e.g. Chrome sends info to Google if a certificate for a google domain is valid but not from the Google Internet Authority) and as soon as that happens then they lose their business (as is what happened to a CA that got hacked).
- pgeorgi 12y ago
  It's the same kind of non-trust you (and others) assert over CAcert. See how well that model worked with Comodo and TurkTrust - both of which are still in business and in default CA lists, which is counter to your assertion that careful CA operation makes business sense. Unfortunately there's no will with browser vendors to _really_ improve matters (maybe TACK?), so something like CAcert is great should it get implemented (providing some heat to CA providers) and even when not (by showing the browser vendors' hypocrisy).

Karunamon 12y ago

Where would this be? And do they attempt to charge money on things that really don't need it? I.e. rekeys and renewals? What about wildcard domains? The same damn cert with a *. instead of a domain. shouldn't cost 10x more.

abritishguy 12y ago
I sell certificates: https://www.volcanicpixels.com/ssl/ https://www.volcanicpixels.com/ssl/ You can get the same certificates for much cheaper here: https://www.thesslstore.com/ https://www.thesslstore.com/ The certificates are absolutely identical, my customers use my site because it is well designed and easy to use and I do everything I can to provide great support, but if you know exactly what you are doing then I would recommend getting them directly from thesslstore - unless you have a desire to help pay for my uni education ;)
- Karunamon 12y ago
  Thanks for pointing it out to me, but there are still some big failures there. First, the site appears broken. The "Purchase SSL" link on the front page goes to a 404. Second, the absolute cheapest certificate I could find anywhere was Certum's BasicID which costs $9.95 for one year. Third, the dark pattern of presenting a lower price up front ($8), but then you find that this only applies if you spring for more than one year. Misleading and weak. Finally, A wildcard certificate from the same company appears to cost $65.83/yr, (which goes up to $79.00 once you click on the link and realize that was the three year price.) Not going to lie, this website leaves me feeling very skewed out, and still costs too much for what you're getting anyways.
  - abritishguy 12y ago
    Sorry, I haven't looked at the site in a while and it has changed a lot. Wildcard certificates are rarely economical compared with just buying individual certs for the subdomains. > the dark pattern of presenting a lower price up front ($8), but then you find that this only applies if you spring for more than one year. Misleading and weak. Absolutely agree! If you send me an email then I'll make you a coupon to get a certificate for £5 (just over cost price) on my site: https://www.volcanicpixels.com/ssl/ https://www.volcanicpixels.com/ssl/ (which is open source: https://github.com/volcanicpixels/volcanicpixels/ https://github.com/volcanicpixels/volcanicpixels/)
    - 12y ago

nomailing 12y ago

5$ is expensive. Don't you know that there are other countries in the world and that the Internet is not only used by the US. There are also other age groups. If a 10 year old boy has a hobby website 5$ might be a price which is unacceptable. what would you say if I as a billionaire tell you that cars for less than 50 000 $ are not needed because all Ferraris are not expensive. So please don't use your subjective experience as an argument against cheap security solutions. They have a point to exist. Nobody should have the right to set the lower limit of how much you have to pay to secure your website. Commericial CAs cannot guarantee the security of your favorite site as we all learned from the heartbleed bug. So there is nit argument to favor them and block community solutions.

abritishguy 12y ago
I'm not American, so yes I am well aware. >If a 10 year old boy has a hobby website 5$ might be a price which is unacceptable. Why would this site need SSL?
- aragot 12y ago
  Because he has users and he wants to keep their private info under encrypted channels? Hobby sites quickly become apps (even as small as phpBB) and it would be good if we SSL'd everything.
lawnchair_larry 12y ago
http://en.wikipedia.org/wiki/Reductio_ad_absurdum http://en.wikipedia.org/wiki/Reductio_ad_absurdum A 10 year old with a hobby site in a third world country doesn't need a $5 certificate. Neither does a rich 10 year old with a hobby site for that matter, but he can purchase one if he wants.

quasque 12y ago

They can even be picked up for free. At least one commercial CA issues free certificates as a matter of routine and (unlike CAcert) has its root certificate in all major OSes and browsers. Alternatively, if you already have a paid cert then some providers offer a free cert via 'competitive upgrade' programmes, if you switch to them (rather unethically, this also used to work to freely upgrade short-term trial certificates to full ones).

abritishguy 12y ago
Startcom charge for revocations though, which IMO is a very bad thing.
- quasque 12y ago
  They do, but I'm not convinced that it matters - I'd be very surprised if there's any overlap between websites that use the free StartSSL cert, and websites that are worth the effort of hijacking the cert and MITMing.