4 ms·

SSL will never be good, Encryption which only a few can afford is mostly not good. Also most SSL Providers have their seat in USA, which also means that we NEVE

by merb 11y ago

SSL will never be good, Encryption which only a few can afford is mostly not good. Also most SSL Providers have their seat in USA, which also means that we NEVER knew if the encryption could be decrypted. Encryption which will be held by any "bigger" company will also have this flaw, even from germany or any other european company (any company in any country will have that flaw). The only encryption that would work, would be self made encryption, which is barely supported by browsers. http://en.wikipedia.org/wiki/DNS-based_Authentication_of_Named_Entities#Applications http://en.wikipedia.org/wiki/DNS-based_Authentication_of_Nam...

fmela 11y ago
Regarding your first point, the people at https://letsencrypt.org/ https://letsencrypt.org/ are working to address that.
- Grue3 11y ago
  letsencrypt.org seems to be the new GNU Hurd or Duke Nukem Forever.
ikeboy 11y ago
An SSL provider doesn't have your encryption keys. They could MITM your site, but at a risk that whoever gets MITMed has cryptographic proof that they issued a cert illegally, which if publicised would get them dropped. See google/china for the most recent incident where this happened. Also, if you simply implement public key pinning, you can no longer be MITMed.
vtlynch 11y ago
These points have been debunked dozens of times. SSL is EASILY affordable. Not only are there free options, but many sites provide widely-trusted certs for around $7/yr. There is little legitimacy behind the claims that the US has backdoored encryption via the actual algorithm. Cryptography professionals have pointed to a few specific ECC curves that may have issues but there is nothing conslusive. Im assuming by "self made encryption" you mean self-signed certs. These will never work - first off they do nothing to compensate for algorithmic flaws which you purport exist. They also provide no identity assurance, which makes it impossible to determine the difference between a legitimate/illegitimate key change.
- yellowapple 11y ago
  > Not only are there free options Last I checked, there's no plural in that; the only free certs available (as far as I know) are the ones from StartSSL, and these aren't free to businesses (or individuals who don't have a residential mailing address and had to rely on a P.O. Box, as was my case), and the customer support makes Comcast look heavenly in comparison. And no, Let's Encrypt doesn't count yet. > but many sites provide widely-trusted certs for around $7/yr. Which ones? I'd be interested in making more of my things SSL'd if I knew I could get certs for that cheap. Are those for specific domains or are they wildcards? If the former, does a www cert cover the apex domain (or vice versa)?
drzaiusapelord 11y ago
>Providers have their seat in USA We have evidence of Putin using Kaspersky to find the identity of political dissidents and other awful things. Meanwhile, you have conspiracy theories that get you upvotes on reddit and other kiddie sites, but zero proof SSL has been infiltrated. Personally, if these companies weren't US or EU I would be worried. I don't think Russia or China are the freedom and human rights utopias you think they are. 57 and 91 on the Human Rights Development Index impresses no one. http://en.wikipedia.org/wiki/List_of_countries_by_Human_Development_Index http://en.wikipedia.org/wiki/List_of_countries_by_Human_Deve...
- ikeboy 11y ago
  I think some of the Snowden docs claimed SSL was cracked. Edit: look up BULLRUN.

by merb 11y ago

fmela 11y ago

Regarding your first point, the people at https://letsencrypt.org/ https://letsencrypt.org/ are working to address that.

Grue3 11y ago
letsencrypt.org seems to be the new GNU Hurd or Duke Nukem Forever.

ikeboy 11y ago

An SSL provider doesn't have your encryption keys. They could MITM your site, but at a risk that whoever gets MITMed has cryptographic proof that they issued a cert illegally, which if publicised would get them dropped. See google/china for the most recent incident where this happened. Also, if you simply implement public key pinning, you can no longer be MITMed.

vtlynch 11y ago

These points have been debunked dozens of times. SSL is EASILY affordable. Not only are there free options, but many sites provide widely-trusted certs for around $7/yr. There is little legitimacy behind the claims that the US has backdoored encryption via the actual algorithm. Cryptography professionals have pointed to a few specific ECC curves that may have issues but there is nothing conslusive. Im assuming by "self made encryption" you mean self-signed certs. These will never work - first off they do nothing to compensate for algorithmic flaws which you purport exist. They also provide no identity assurance, which makes it impossible to determine the difference between a legitimate/illegitimate key change.

yellowapple 11y ago
> Not only are there free options Last I checked, there's no plural in that; the only free certs available (as far as I know) are the ones from StartSSL, and these aren't free to businesses (or individuals who don't have a residential mailing address and had to rely on a P.O. Box, as was my case), and the customer support makes Comcast look heavenly in comparison. And no, Let's Encrypt doesn't count yet. > but many sites provide widely-trusted certs for around $7/yr. Which ones? I'd be interested in making more of my things SSL'd if I knew I could get certs for that cheap. Are those for specific domains or are they wildcards? If the former, does a www cert cover the apex domain (or vice versa)?

drzaiusapelord 11y ago

>Providers have their seat in USA We have evidence of Putin using Kaspersky to find the identity of political dissidents and other awful things. Meanwhile, you have conspiracy theories that get you upvotes on reddit and other kiddie sites, but zero proof SSL has been infiltrated. Personally, if these companies weren't US or EU I would be worried. I don't think Russia or China are the freedom and human rights utopias you think they are. 57 and 91 on the Human Rights Development Index impresses no one. http://en.wikipedia.org/wiki/List_of_countries_by_Human_Development_Index http://en.wikipedia.org/wiki/List_of_countries_by_Human_Deve...

ikeboy 11y ago
I think some of the Snowden docs claimed SSL was cracked. Edit: look up BULLRUN.