Re:Chrome 68 Released: HTTP Sites Marked as “Not Secure”
by gaius on Wednesday July 25, 2018 @06:51AM
(#17608283)
Indeed. Let’s Encrypt would happily issue a cert to scams4u.com provided only proof that the person making the request has control over the domain (that really is all they check). “Secure” implies far, far more than merely “encrypted”. The biggest security problems are behind the web server, not between you and it!
[ Parent
| on HN ]
Re:Chrome 68 Released: HTTP Sites Marked as “Not Secure”
by mort96 on Wednesday July 25, 2018 @07:12AM
(#17608368)
I know it probably wasn't your intention to single out Let's Encrypt, but it's probably worth mentioning that almost any registrar, not just LE, would issue a certificate for a scam site, provided they can prove they own the domain.
Re:Chrome 68 Released: HTTP Sites Marked as “Not Secure”
by gaius on Wednesday July 25, 2018 @07:23AM
(#17608408)
It wasn’t always like that. In the 90s I remember to get a cert we had to pay a fee for a background check (Dun & Bradstreet, Companies House, etc). Obviously not foolproof but a massively greater assurance than anyone gets today.
Re:Chrome 68 Released: HTTP Sites Marked as “Not Secure”
by tazard on Wednesday July 25, 2018 @08:18AM
(#17608661)
Would it be better if your phished credentials were MITM'd by a third party scammer due to being sent in clear text instead of going directly to the original scammers? I for one don't think so.
Re:Chrome 68 Released: HTTP Sites Marked as “Not Secure”
by gaius on Wednesday July 25, 2018 @08:29AM
(#17608707)
Of all the recent high profile breaches, none would have been mitigated by HTTPS, or occurred anyway.
Let me clarify that I don’t object to encryption - I object to telling the user “this site is secure” when there is no way to know that