Technology

59434 readers

3818 users here now

This is a most excellent place for technology news and articles.

Our Rules

Follow the lemmy.world rules.
Only tech related content.
Be excellent to each another!
Mod approved content bots can post up to 10 articles per day.
Threads asking for personal tech support may be deleted.
Politics threads may be removed.
No memes allowed as posts, OK to post as comments.
Only approved bots from the list below, to ask if your bot can be added please contact us.
Check for duplicates before posting, duplicates may be removed

Approved Bots

founded 1 year ago

MODERATORS

[email protected]

495

Let's Encrypt is 10 years old today ! (letsencrypt.org)

submitted 9 hours ago by [email protected] to c/[email protected]

23 comments fedilink hide all child comments

Happy birthday to Let's Encrypt !

Huge thanks to everyone involved in making HTTPS available to everyone for free !

you are viewing a single comment's thread
view the rest of the comments

[–] [email protected] 1 points 2 hours ago (1 children)

Correct me if I'm wrong, but isn't the CA only signing your public key to prove identity/authority? I don't think the CA can magically MITM every cert they sign.

The impact is serious enough to warrant a $1m entry fee, IMO. At best, someone could impersonate a site. They'd also have to get other things in line (e.g. DNS hijacking) to be at all successful anyway. And it's not like most people are authenticating certs themselves. They just trust browsers to trust CAs that vouch for you and prevents those scary browser warnings.

It doesn't improve encryption compared to a self-signed cert though.

[–] [email protected] 2 points 2 hours ago* (last edited 1 hour ago)

If you are the CA, you can sign a new certificate yourself for google.com and the browser will accept it. It's effectively allows MITM for any certificate. Worse, it's not even limited to certificates under that CA. The browser has no way of knowing there's 2 "valid" certs at once, and in fact that is allowed regardless (multiple servers with different instances of the SSL cert is a possibility).

Certificate pinning might save things, since that will force the same certificate as was previously used, but I'm not sure this is a common default.