News for hackers. Stuff that matters.

A comment on Let's Encrypt tls-sni-01 disabled due to credible vulnerability report. Parent comment

Re:Let's Encrypt tls-sni-01 disabled due to credible vulnera... by codemac on Tuesday January 09, 2018 @10:41PM (#16112392)
So an attack against one challenge doesn't deterministically succeed.
[ Parent | on HN ]
Re:Let's Encrypt tls-sni-01 disabled due to credible vulnera... by stephenr on Tuesday January 09, 2018 @11:16PM (#16112512)
The much greater likely scenario is an error in comms/le (such as this issues today) means Caddy will un-deterministically fail
[ Parent | on HN ]
Re:Let's Encrypt tls-sni-01 disabled due to credible vulnera... by codemac on Wednesday January 10, 2018 @12:28AM (#16112751)
That is a trade-off for false negatives rather than false positives. It is not an unreasonable choice when dealing with certificates.
[ Parent | on HN ]
Re:Let's Encrypt tls-sni-01 disabled due to credible vulnera... by stephenr on Wednesday January 10, 2018 @12:34AM (#16112776)
The default client recommended by LE (certbot) supports multi-challenge registration/renewal. I'm pretty sure I trust their judgement over that of the Caddy project, given their (Caddy) history of weird decisions that backfire and cause user issues.
[ Parent | on HN ]