Hacker News Reader

Comment by rurban | Hacker News Reader

You do want to support a non-commercial and community driven CA cert authority, because you don't want to rely on commercial-only cert's which are not based on technical merits, just on friendship and common business interests.

You really want a free HTTPS connection to your favorite open source projects login page, and do not force them to pay yearly CA update fees to not trustworthy cert authorities for no reason.

Currently you need to add the cacert into your keychain on some distros manually. See http://wiki.cacert.org/FAQ/ImportRootCert

View on HN

I do not want to support a non-commercial and community driven CA cert authority[sic] that does not meet commonly accepted CA audit requirements.

My favorite open source project's login page can use self signed cert. I can download the ssl.key.asc or project.crt.asc that the project publishes on the web page or git repository and verify the signatures using the same gpg key I use to verify the project tarballs.

None of what you are saying actually matters (regardless of one's position on those issues), because it's trumped by the fact that if you use cacert, users can't reach your site. It's wrong to defer this problem to the user, always.

Certificates are not expensive, they can be picked up for $5.

Why should I pay a not-trustworthy company, when I can get one for free, from a widely respected and completely open sourced and community managed authority?

"not-trustworthy"

The process of obtaining an SSL certificate does not involve divulging your private key to the CA so what are you trusting them with? In reality you are trusting them not to sign certificates for sites not owned or administered by the person requesting it, they could (in theory) do this whether you got your certificate from them or not. In practice they cannot do this on a widespread scale without it being detected (e.g. Chrome sends info to Google if a certificate for a google domain is valid but not from the Google Internet Authority) and as soon as that happens then they lose their business (as is what happened to a CA that got hacked).

It's the same kind of non-trust you (and others) assert over CAcert.

See how well that model worked with Comodo and TurkTrust - both of which are still in business and in default CA lists, which is counter to your assertion that careful CA operation makes business sense.

Unfortunately there's no will with browser vendors to _really_ improve matters (maybe TACK?), so something like CAcert is great should it get implemented (providing some heat to CA providers) and even when not (by showing the browser vendors' hypocrisy).

Where would this be? And do they attempt to charge money on things that really don't need it? I.e. rekeys and renewals? What about wildcard domains? The same damn cert with a *. instead of a domain. shouldn't cost 10x more.

I sell certificates: https://www.volcanicpixels.com/ssl/

You can get the same certificates for much cheaper here: https://www.thesslstore.com/

The certificates are absolutely identical, my customers use my site because it is well designed and easy to use and I do everything I can to provide great support, but if you know exactly what you are doing then I would recommend getting them directly from thesslstore - unless you have a desire to help pay for my uni education ;)

Thanks for pointing it out to me, but there are still some big failures there.

First, the site appears broken. The "Purchase SSL" link on the front page goes to a 404.

Second, the absolute cheapest certificate I could find anywhere was Certum's BasicID which costs $9.95 for one year.

Third, the dark pattern of presenting a lower price up front ($8), but then you find that this only applies if you spring for more than one year. Misleading and weak.

Finally, A wildcard certificate from the same company appears to cost $65.83/yr, (which goes up to $79.00 once you click on the link and realize that was the three year price.)

Not going to lie, this website leaves me feeling very skewed out, and still costs too much for what you're getting anyways.

Sorry, I haven't looked at the site in a while and it has changed a lot.

Wildcard certificates are rarely economical compared with just buying individual certs for the subdomains.

> the dark pattern of presenting a lower price up front ($8), but then you find that this only applies if you spring for more than one year. Misleading and weak.

Absolutely agree!

If you send me an email then I'll make you a coupon to get a certificate for £5 (just over cost price) on my site: https://www.volcanicpixels.com/ssl/ (which is open source: https://github.com/volcanicpixels/volcanicpixels/)

The offer is appreciated but I'll pass - my reason for wanting SSL is not a business one, rather an annoyance one (i.e. alerts every time I hit my self-signed sites).

Aside: the way you keep mentioning your URL over and over seems really spammy.

That's nice, but spamming your product all over the comments to this post rather discourages me from using your services.

5$ is expensive. Don't you know that there are other countries in the world and that the Internet is not only used by the US. There are also other age groups. If a 10 year old boy has a hobby website 5$ might be a price which is unacceptable.

what would you say if I as a billionaire tell you that cars for less than 50 000 $ are not needed because all Ferraris are not expensive. So please don't use your subjective experience as an argument against cheap security solutions. They have a point to exist. Nobody should have the right to set the lower limit of how much you have to pay to secure your website. Commericial CAs cannot guarantee the security of your favorite site as we all learned from the heartbleed bug. So there is nit argument to favor them and block community solutions.

I'm not American, so yes I am well aware.

>If a 10 year old boy has a hobby website 5$ might be a price which is unacceptable. Why would this site need SSL?

Because he has users and he wants to keep their private info under encrypted channels?

Hobby sites quickly become apps (even as small as phpBB) and it would be good if we SSL'd everything.

http://en.wikipedia.org/wiki/Reductio_ad_absurdum

A 10 year old with a hobby site in a third world country doesn't need a $5 certificate. Neither does a rich 10 year old with a hobby site for that matter, but he can purchase one if he wants.

They can even be picked up for free.

At least one commercial CA issues free certificates as a matter of routine and (unlike CAcert) has its root certificate in all major OSes and browsers.

Alternatively, if you already have a paid cert then some providers offer a free cert via 'competitive upgrade' programmes, if you switch to them (rather unethically, this also used to work to freely upgrade short-term trial certificates to full ones).

Startcom charge for revocations though, which IMO is a very bad thing.

They do, but I'm not convinced that it matters - I'd be very surprised if there's any overlap between websites that use the free StartSSL cert, and websites that are worth the effort of hijacking the cert and MITMing.

Reply on news.ycombinator.com