Stories
Slash Boxes
Comments

SoylentNews is people

posted by mrpg on Thursday July 20 2017, @04:20AM   Printer-friendly
from the green-padlock dept.

Submitted via IRC for Bytram

Let's Encrypt is the largest certificate authority by volume doling out more than 100,000 free domain certificates a day. The non-profit fulfills a noble mission of securing website communications that is applauded across the internet; it has raised the bar on SSL and TLS security, issuing 100 million HTTPS certificates as of June 2017.

However, despite industry accolades by privacy activists and praise from those in the security community for its mission, some critics are sounding alarm bells and warning that Let's Encrypt might be guilty of going too far, too fast, and delivering too much of a good thing without the right checks and balances in place.

[...] "Unsuspecting users might think they are communicating with trustworthy sites because the identity of the site has been validated by a CA, without realizing that these are just domain validation certificates with no assurance about the identity of the organization that owns the site," said Asif Karel, director of product management at Qualys.

[...] "Let's Encrypt can absolutely be abused," said Josh Aas, executive director of the Internet Security Research Group, the organization that oversees Let's Encrypt. "But so can't any other certificate authority. People act like Let's Encrypt is the first CA to be abused. This is preposterous."

[...] Jett and others applaud the accomplishments of Let's Encrypt, but believe the organization, founded by Mozilla, Cisco and the Electronic Frontier Foundation, is in a unique position to take a leadership role that could be used to crack down on certificate abuse when it comes to better vetting of applicants in order to weed out criminals.

Source: https://threatpost.com/free-certs-come-with-a-cost/126861/


Original Submission

 
This discussion has been archived. No new comments can be posted.
Display Options Threshold/Breakthrough Mark All as Read Mark All as Unread
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
  • (Score: 2) by Pino P on Thursday July 20 2017, @03:35PM

    by Pino P (4721) on Thursday July 20 2017, @03:35PM (#541936) Journal

    What would be hard is stealing an offline javascript signing key that was only used to sign production ready versions of javascript, with browsers providing a method to pin/log/authenticate the script against a file size+checksum+signature, thus ensuring the origin of the script was from the expected source

    How would this "method to pin/log/authenticate the script" work without requiring hobbyists and startups to pay hundreds of dollars per year for a code signing certificate? And how would it work for a developer tool such as JSFiddle, which runs user-entered scripts as its primary functionality, or a site like Wikipedia, which lets a registered editor paste editing aid scripts into his user page?

    Starting Score:    1  point
    Karma-Bonus Modifier   +1  

    Total Score:   2