News for hackers. Stuff that matters.

A comment on Let's Encrypt has issued its first million certificates. Parent comment

Re:Let's Encrypt has issued its first million certificates by lucb1e on Tuesday March 08, 2016 @01:37PM (#11247383)
So they force either a valid cert or nothing? Not even unencrypted http/2? Because that would be quite awesome.

Edit: are there statements where they say they don't intend to implement it ever, or is it just not supported yet and e.g. Microsoft might still implement it later to please some enterprise stakeholder?

[ Parent | on HN ]
Re:Let's Encrypt has issued its first million certificates by pfg on Tuesday March 08, 2016 @01:45PM (#11247454)
According to this[1], that's a permanent decision. Given that both Google and Mozilla have discussed plans that would eventually mark http:// as unsafe in the UI, I don't think that decision is going to change.

[1]: https://daniel.haxx.se/blog/2015/03/06/tls-in-http2/

[ Parent | on HN ]
Re:Let's Encrypt has issued its first million certificates by lucb1e on Tuesday March 08, 2016 @01:46PM (#11247468)
Well there is a difference between unsigned encrypted and unencrypted, I'm not saying marking http:// as unsafe implies that they'll always regard unsigned encrypted as completely unprotected, especially with closed source browsers (or browsers where development is a closed process).

Thanks for all the information though! :)

[ Parent | on HN ]
Re:Let's Encrypt has issued its first million certificates by aidenn0 on Tuesday March 08, 2016 @11:57PM (#11251023)
From the point of view of an active MITM attack there is no difference between unsigned encrypted and unencrypted.
[ Parent | on HN ]