←back to thread

Let's Encrypt is 10 years old now

(letsencrypt.org)
512 points gslin | 1 comments | 20 Nov 24 06:13 UTC | HN request time: 0.211s | source
Show context
pests ◴[20 Nov 24 07:45 UTC] No.42191619[source]▶
It feels like just yesterday I was paying for certs, or worst, just running without.

Can't believe its been ten years.

replies(1): >>42191666 #
ozim ◴[20 Nov 24 07:52 UTC] No.42191666[source]▶
Can’t believe there are still anti TLS weirdos.
replies(7): >>42191688 #>>42191718 #>>42191893 #>>42192714 #>>42192733 #>>42193057 #>>42193614 #
1. dspillett ◴[20 Nov 24 11:57 UTC] No.42193057[source]▶
Or worse: people who still go on and on about how self-signed certificates should be accepted by browsers, and can't be convinced that blind-trust-no-first-use is lousy security.

They usually counter with “but SSH uses TOFU” because they don't see, and can't be convinced of, the problem of not verifying the server key signature⁰. I can be fairly sure that I'm talking to the daemon that I've just setup myself without explicitly checking the signature¹, but that particular side-channel assurance doesn't apply to, for example, a client connecting to our SFTP endpoint for the first time² to send us sensitive data.

--

[0] Basically, they get away with doing SSH wrong, and want to get away with doing HTTPS wrong the same way.

[1] Though I still should, really, and actually do in DayJob.

[2] Surprisingly few banks' tech teams bother to verify SSH server signatures on first connection, I know because the ones in our documentation were wrong for a time and no one queried the matter before I noticed it when reviewing that documentation while adding further details. I doubt they'd even notice the signature changing unexpectedly even though that could mean something very serious is going on.