Stories
Slash Boxes
Comments

SoylentNews is people

posted by mrpg on Thursday July 20 2017, @04:20AM   Printer-friendly
from the green-padlock dept.

Submitted via IRC for Bytram

Let's Encrypt is the largest certificate authority by volume doling out more than 100,000 free domain certificates a day. The non-profit fulfills a noble mission of securing website communications that is applauded across the internet; it has raised the bar on SSL and TLS security, issuing 100 million HTTPS certificates as of June 2017.

However, despite industry accolades by privacy activists and praise from those in the security community for its mission, some critics are sounding alarm bells and warning that Let's Encrypt might be guilty of going too far, too fast, and delivering too much of a good thing without the right checks and balances in place.

[...] "Unsuspecting users might think they are communicating with trustworthy sites because the identity of the site has been validated by a CA, without realizing that these are just domain validation certificates with no assurance about the identity of the organization that owns the site," said Asif Karel, director of product management at Qualys.

[...] "Let's Encrypt can absolutely be abused," said Josh Aas, executive director of the Internet Security Research Group, the organization that oversees Let's Encrypt. "But so can't any other certificate authority. People act like Let's Encrypt is the first CA to be abused. This is preposterous."

[...] Jett and others applaud the accomplishments of Let's Encrypt, but believe the organization, founded by Mozilla, Cisco and the Electronic Frontier Foundation, is in a unique position to take a leadership role that could be used to crack down on certificate abuse when it comes to better vetting of applicants in order to weed out criminals.

Source: https://threatpost.com/free-certs-come-with-a-cost/126861/


Original Submission

 
This discussion has been archived. No new comments can be posted.
Display Options Threshold/Breakthrough Mark All as Read Mark All as Unread
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
  • (Score: 0) by Anonymous Coward on Thursday July 20 2017, @07:29PM

    by Anonymous Coward on Thursday July 20 2017, @07:29PM (#542032)

    > You can't do encryption with ASICs or FPGAs in a consumer device.

    Cryptographic accelerator cards for servers already exist (example [netgate.com]). Consumer devices have acceleration baked into the processor: [wikipedia.org]

    Modern x86 CPUs support Advanced Encryption Standard (AES) encoding and decoding in hardware, using the AES instruction set proposed by Intel in March 2008.

    Allwinner Technology provides a hardware cryptographic accelerator in its A10, A20, A30 and A80 ARM system-on-chip series, and all ARM CPUs have acceleration in the later ARMv8 architecture. The accelerator provides the RSA public-key algorithm, several widely used symmetric-key algorithms, cryptographic hash functions, and a cryptographically secure pseudo-random number generator.[1]