News for hackers. Stuff that matters.
Re:Keeping secrecy the exception, not the rule by e12e on Saturday April 16, 2016 @01:01AM (#11509400)
But if Letsencrypt were served with an NSL demanding access to their signing keys, how would we know?
Re:Keeping secrecy the exception, not the rule by zrm on Saturday April 16, 2016 @02:40AM (#11509572)
That isn't what it's for. You can assume the government (really any government) has control over at least one CA.

What Let's Encrypt does against state-level actors is let people easily use HTTPS instead of HTTP without subjecting their users to self-signed certificate warnings.

A government could still MITM the connection but that requires an active attack rather than passive surveillance. And active attacks are subject to detection. So it protects against undetectable mass surveillance.

Re:Keeping secrecy the exception, not the rule by lorenzhs on Saturday April 16, 2016 @02:43AM (#11509579)
That would allow the government to issue new certificates, not to decrypt traffic to sites using letsencrypt certificates. Active man in the middle attacks are rather noisy, and things like HPKP exist to prevent such attacks
Re:Keeping secrecy the exception, not the rule by DenisM on Saturday April 16, 2016 @05:59PM (#11512444)
Cert pinning makes it a difficult and expensive attack to carry out.