Hacker News Reader

Comment by schoen | Hacker News Reader

(I work on Let's Encrypt.)

Let's Encrypt doesn't ever possess your private keys, doesn't know who connects to your site if you use OCSP stapling, and doesn't control what kind of cryptography you use when negotiating TLS sessions with your site visitors. Let's Encrypt also doesn't need any contact information from you when you obtain a certificate.

Let's Encrypt certificates aren't trusted by Chrome without a proof of inclusion in public Certificate Transparency logs, so all issued certificates have to be disclosed.

As I've said in a number of HN comments, the people working on Let's Encrypt generally still think that the CA system is too powerful, and are happy for your suggestions about how about it can made more transparent and less powerful.

View on HN

> can made more transparent and less powerful

Looking forward to it. I imagine, when SSL becomes mandatory by browsers, it can be used for censorship.

That's definitely a serious and important problem.

>when SSL becomes mandatory by browsers, it can be used for censorship.

Can someone explain how that works? I thought SSL would make censorship less practical.

Like this:

https://nakedsecurity.sophos.com/2013/01/08/the-turktrust-ss...

Anything that gets into your bundle establishes incredible power over you.

I think what buboard is talking about is that CAs can revoke certificates that they've issued, and can refuse to issue certificates to particular sites. Someone might pressure CAs to do this for a content censorship purpose, much in the way that people pressure other kinds of intermediaries and technical infrastructure providers when they find some online site or content or activity objectionable.

SSL depends on national agencies and orgs overseen by national agencies.

If SSL is required, then whoever controls those agencies controls what's seen online.

I already cannot easily add a root CA for .onion addresses and then make my own certs there, without browsers screaming bloody murder.

I already cannot bypass cert errors for certain types of cert fails.

Tor onion sites, which are end to end encrypted, are considered "insecure" because we plebes cannot buy a "proper" EV ssl cert, like Facebook did.

Enforcement of SSL is just another way of controlling the user in name of "stupidity". Sure, the dumb click-anything users win, but anyone tech-savy loses freedoms.

> I already cannot easily add a root CA for .onion addresses and then make my own certs there, without browsers screaming bloody murder.

How would you want this to work? What would you want to do, and what would you want browsers to do in response?

Not taking input from google about who to block (iirc it still use google's safe browsing list) would be nice. That just doesn't feel safe to me, not to mention idealogical reasons. But that's just my opinion I guess.

https://letsencrypt.org/2015/10/29/phishing-and-malware.html

Reply on news.ycombinator.com