Hacker News Reader

Comment by falcolas | Hacker News Reader

Funny how Let’s Encrypt is so popular because it doesn’t inconvenience people, and as a result more websites than ever have been secured, to the betterment of society.

View on HN

That's because the purpose of SSL encryption changed. It used to be primarily to protect payment information and sometimes also used for logins, but it was considered too heavy for all traffic in the past. Now it's used primarily to ensure all traffic is secure, and payment is along for the ride.

In the past you used to be fairly sure a company was somewhat legitimate and responsible if they has an SSL cert and could supply card information to them without too much worry, as someone had vetted them as a real company (to some degree). These days, that doesn't happen, and whether I'm willing to give a company my credit card has nothing to do with if they are secured with a cert (which is a bare minimum to use the site). That cert doesn't really imply much anymore though. These days, I'll only enter my card into large reputable sites, or if they are using a payment service I trust (PayPal, Amazon, Square, etc), as they've presumably done a lot of the vetting that the SSL companies traditionally did.

There is a huge difference of what kind of identity is established: Let's Encrypt tells you basically that you are actually talking to the right server, whereas EV certs for signing binaries tell you which company that actually exists in the real world owns the certificate.

Also, for a lot of sites they've outsourced their payment systems (which was the main reason for SSL certs in the past), so you can place less importance on the SSL cert if the payment gateway is PayPal, or Amazon, or Squarespace, and they are essentially providing the same assurance (and are a responsible party you can contact to reverse charges if you suspect fraud).

At this point, I'm very hesitant to enter any credit card info into a site itself, even if it's secured through an SSL cert. It doesn't really signify what it used to.

And aside from signing certs being a racket, it makes sense for LE to be easier than getting a code signing cert! If the server I land on is a malicious website, I can close the tab. If the app I installed turns out to be malicious odds are good that I have to reformat my machine and restore an old backup, plus change all my security credentials because the malware exfiltrated them.

But no one cares DV/OV/EV differences for web certs.

Reply on news.ycombinator.com