SoylentNews

Free Certs Come With a Cost

posted by mrpg on Thursday July 20 2017, @04:20AM   
from the green-padlock dept.

MrPlow writes:

Submitted via IRC for Bytram

Let's Encrypt is the largest certificate authority by volume doling out more than 100,000 free domain certificates a day. The non-profit fulfills a noble mission of securing website communications that is applauded across the internet; it has raised the bar on SSL and TLS security, issuing 100 million HTTPS certificates as of June 2017.

However, despite industry accolades by privacy activists and praise from those in the security community for its mission, some critics are sounding alarm bells and warning that Let's Encrypt might be guilty of going too far, too fast, and delivering too much of a good thing without the right checks and balances in place.

[...] "Unsuspecting users might think they are communicating with trustworthy sites because the identity of the site has been validated by a CA, without realizing that these are just domain validation certificates with no assurance about the identity of the organization that owns the site," said Asif Karel, director of product management at Qualys.

[...] "Let's Encrypt can absolutely be abused," said Josh Aas, executive director of the Internet Security Research Group, the organization that oversees Let's Encrypt. "But so can't any other certificate authority. People act like Let's Encrypt is the first CA to be abused. This is preposterous."

[...] Jett and others applaud the accomplishments of Let's Encrypt, but believe the organization, founded by Mozilla, Cisco and the Electronic Frontier Foundation, is in a unique position to take a leadership role that could be used to crack down on certificate abuse when it comes to better vetting of applicants in order to weed out criminals.

Source: https://threatpost.com/free-certs-come-with-a-cost/126861/

---

Original Submission

• User agents that distinguish DV from OV certs (Score: 3, Informative) by Pino P on Thursday July 20 2017, @02:53PM

  by Pino P (4721) on Thursday July 20 2017, @02:53PM (#541921) Journal

  The real truth is that the for profit CA authorities are gouging money from their customers and not providing one thing extra.

  Unlike Let's Encrypt, which offers only domain-validated (DV) certificates, for-profit CAs offer organization-validated (OV) and Extended Validation certificates. This affects users of browsers and search engines that treat OV certificates differently from DV certificates:

  SiteTruth

  The SiteTruth service [sitetruth.com] that assigns one of four levels of trust to each ad's target, from lowest to highest being "do not enter: commercial site that hasn't published an identifiable Latin-script address", "non-commercial site", "commercial site that has published an address and has a DV certificate", and "commercial site that has published an address and has a OV or EV certificate or a Better Business Bureau seal". There used to be a web search engine that displayed the trust level for each site; now all I can find is an "Ad Limiter" extension for Chrome that hides all ads on each search result page except the one for the most trustworthy business.

  Comodo Dragon and IceDragon browsers

  Comodo publishes rebranded versions of Chromium and Firefox that try to make domain-validated certificates conspicuous. In various versions, this has ranged from an interstitial similar to that for self-signed certificates [netcraft.com] to a lock with a triangle (the same icon used for mixed content). Only a CA's claim of a subject's real-world identity (that is, an OV or stronger cert) shuts up Dragon.

  Parent

  Starting Score:	1		point
  Moderation		+1
  Informative=1, Total=1
  Extra 'Informative' Modifier		0
  Karma-Bonus Modifier		+1
  Total Score:		3