News for hackers. Stuff that matters.
Re:Ask HN: Is Let's Encrypt Harmful? by detaro on Thursday January 14, 2016 @02:12PM (#10903617)
Most SSL certificates use the same validation mechanisms as Let's Encrypt. Let's Encrypt is not less secure than other providers of domain validated (DV) certificates, all they check is that the requester of the certificate has some kind of control over the domain at the time of the request.

You couldn't trust SSL for owner identity before Let's Encrypt either, nothing has changed.

If you want stronger guarantees for the identity of the owner, you'll have to look for Extended Validation (EV) certificates (Browsers generally show the company name next to the lock in the URL bar). (https://www.cloudflare.com/ as an example, HN or https://www.amazon.com as examples of sites that don't use EV)

Re:Ask HN: Is Let's Encrypt Harmful? by crapsalot on Thursday January 14, 2016 @08:56PM (#10906542)
Wrong.

Most SSL cert CA's check DNS for email addresses and only validate DNS entries.

Lets Encrypt only checks DNS for IP addresses and issues certs based on root access to the IP addresses.

A CA DV is not equivalent to a Lets Encrypt cert.

Re:Ask HN: Is Let's Encrypt Harmful? by detaro on Friday January 15, 2016 @12:36PM (#10910742)
Most CAs accept an email to an predetermined address at the domain, which validates that a DNS entry (MX record) on the domain points to a server controlled by the requester.

Many also offer the same thing as Let's Encrypt, which basically verifies if the A/AAAA record for the domain points to a server controlled by the requester.

What am I missing?