,
7 tweets,
2 min read
Read on Twitter
1/ As usual, I'm going to defend @LetsEncrypt. People are demanding more of SSL and certificates than they were designed to secure. If you demand they do more security, then it consequently means fewer will be able to use them.
2/ Things SSL doesn't solve:
a) that the site is secure against hackers breaking in
b) that the site isn't delivering you malware
c) that the DNS name hasn't been hijacked by hacking the registrar
a) that the site is secure against hackers breaking in
b) that the site isn't delivering you malware
c) that the DNS name hasn't been hijacked by hacking the registrar
3/ LetsEncrypt gives a certificate to anybody who can prove they own a domain. If hackers have hacked a domain, then they can get a certificate and MitM all the traffic to the server, including your login password and credit card info. The site still shows a lock icon.
4/ There exist "Extended Validation" certificates that also verify the entity, more than just the domain, but doing so takes work and therefore costs money, a minimum of $100 a year. This is beyond the reach of most websites.
5/ Blogspot automatically gives me SSL on my blog, blog.erratasec.com because they do simple domain validation with LetsEncrypt. This wouldn't be possible if they needed to do extended validation.
6/ With simple domain validation, we get ubiquitous SSL that's so easy it's foolish not to have it, which is why most of the world's SSL certificates are LetsEncrypt. If we demand extended validation everywhere, then these will simply drop SSL support.
7/ More SSL everywhere is absolutely better than only extended validation certificates in fewer websites. Perfect security here is the enemy of good enough security.
