Re:Keeping secrecy the exception, not the rule
by e12e on Saturday April 16, 2016 @01:01AM
(#11509400)
But if Letsencrypt were served with an NSL demanding access to their signing keys, how would we know?
[ Parent
| on HN ]
Re:Keeping secrecy the exception, not the rule
by zrm on Saturday April 16, 2016 @02:40AM
(#11509572)
That isn't what it's for. You can assume the government (really any government) has control over at least one CA.
What Let's Encrypt does against state-level actors is let people easily use HTTPS instead of HTTP without subjecting their users to self-signed certificate warnings.
A government could still MITM the connection but that requires an active attack rather than passive surveillance. And active attacks are subject to detection. So it protects against undetectable mass surveillance.
Re:Keeping secrecy the exception, not the rule
by lorenzhs on Saturday April 16, 2016 @02:43AM
(#11509579)
That would allow the government to issue new certificates, not to decrypt traffic to sites using letsencrypt certificates. Active man in the middle attacks are rather noisy, and things like HPKP exist to prevent such attacks