Comment by chc | Hacker News Reader

Comment by chc | Hacker News Reader

Maybe it's just the effect legalese sometimes has of making your head spin, but that looks like kind of a lot of "ifs" for something that's being touted as so universal it can justify killing HTTP.

A few requirements:

- You have not participated in the seizure of a domain name that had ongoing lawful uses

- all information in Your Certificate regarding You or Your domain name is accurate, current, reliable, complete, and not misleading

- all information You have provided to ISRG is accurate, current, complete, reliable, complete, and not misleading

- You have taken all appropriate, reasonable, and necessary steps to secure and keep your Private Key secret

They can send you away even if you do everything they ask:

- ISRG may, in its sole discretion, refuse to grant Your request for a Let’s Encrypt Certificate, including for reasons not stated in this Agreement

- ISRG may also, without advanced notice, revoke Your Certificate if it determines, in its sole discretion, that … Your Certificate has become unreliable

- ISRG may also, without advanced notice, revoke Your Certificate if it determines, in its sole discretion, that … information in your registration with ISRG or request for an Let’s Encrypt Certificate has changed

also

> ISRG may disclose Private Recovery Information, however, if compelled to do so by court order or other compulsory legal process. If possible, ISRG will give You notice of the potential disclosure and an opportunity to contest it.

this is what I expect, but then they also write

> ISRG may also disclose your PRI if it believes disclosure is necessary to prevent loss of life, personal injury, damage to property, or significant financial harm.

To me that sounds like an easy backdoor for corporate interests (significant financial harm) or law enforcement to bypass court orders. Isn't the legal process there in the first place to ensure that such claims are truthful?

Granted, PRI seems to be about email addresses and phone numbers [possibly more? the text says "such as"], but getting disposable phone numbers is not that easy in some countries.

In particular the "disclose ... if it believes ... financial harm" part seems a little weird.

Disclose to whom? To anybody?

"If it believes" – it's impossible to disprove that someone holds a certain belief. (Can a person who is a non-human corporation even hold beliefs?) Maybe this should say something about "reasonably expect" or something along those lines, something that can be argued about if there is disagreement?

As for financial harm, if I were to run a successful business on my domain, wouldn't my success in attracting customers be doing financial harm to my competitors?

But, of course, IANAL!

Thanks for raising this concern.

One thing to emphasize about the PRI is that (perhaps differently from what you might be used to with some domain registrars or certificate authorities), the PRI is always optional for Let's Encrypt, and is used only in case of a problem such as losing your private key. You don't have to provide the PRI in order to get a cert, and this isn't a backdoor effort to require people to give a legal name in order to get a cert.

Having a working e-mail address is really valuable as a recovery mechanism -- but if you're very confident you won't need that and you don't want to give contact information, you need not do so.

Those seem like fairly reasonable 'ifs' to have. They have to cover themselves and prevent abuse, or else no one will trust the certificates they issue.

> or else no one will trust the certificates they issue

I would. Especially if they refused to cooperate with the US gov't.

They can't allow anybody who has ever been involved in a domain name seizure or no one will trust their certificates? I'm not following the causal chain there.

Why? It seems to me like it should be really simple: I prove I control domain X, they issue me a certificate for domain X. End of story. Does there need to be more?

What if someone hijacks a domain? Should they issue one then?

I'll say this, I don't want to see "Let's Encrypt" go on some moral crusade deciding not to grant a certificate to a website because that website contains offensive content, but their job is to verify at least somewhat the identity of the requester to try and stem impersonation.

> What if someone hijacks a domain?

But that's a registrar problem, not a "proof that this connection comes from someone who controls that domain" problem. These aren't EV certificates.

Part of HTTPS is making sure that the person you're talking to is the person you think you're talking to.

That's what EV certificates are for.

Otherwise https only gurantees that you're actually talking to the domain you see in the URL, not who that domain belongs to.

The fact that I seized a domain ten years ago doesn't mean I'm not who I say I am today.

Also, seizure and hijacking aren't equivalent.

What if a domain expires but a certificate for the domain has been issued by the previous owner?

I would think a cert shouldn't be issued with an expiration date after that of the domain registration itself.

That would work with common gTLDs, but some ccTLDs have a very annoying policy where they only allow one-year renewals and the renewal doesn't show up in the whois until the last moment.

Anyway, it's trivial to find out whether a domain was expired and re-registered. The date of initial registration in the whois will change, so you can just compare it with the value you saw when you first issued a certificate for that domain.

Reply on news.ycombinator.com