News for hackers. Stuff that matters.

A comment on Let's Encrypt Has Issued a Billion Certificates. Parent comment

Re:Let's Encrypt Has Issued a Billion Certificates by JMTQp8lwXL on Thursday February 27, 2020 @11:53AM (#22434992)
These points could be stated for any major certificate issuer. They could encounter an availability issue, bugs, vulnerabilities, etc. The funding model doesn't change these risks.
[ Parent | on HN ]
Re:Let's Encrypt Has Issued a Billion Certificates by niks1101 on Thursday February 27, 2020 @11:57AM (#22435057)
Are any of the other providers this big? 10% of all websites and growing. If the NSA get hold of the keys then it's just like the old days, or am I missing something?
[ Parent | on HN ]
Re:Let's Encrypt Has Issued a Billion Certificates by derefr on Thursday February 27, 2020 @12:18PM (#22435324)
> If the NSA get hold of the keys

In X.509, the CA never sees the private key associated with a certificate. So while a state actor could always manufacture a “legitimate CA-signed” replacement cert and MITM you with it, they can’t do anything about modern defense-in-depth security approaches like certificate pinning, since it’s the particular public key of the original cert being pinned, not the CA’s authority + CN.

[ Parent | on HN ]
Re:Let's Encrypt Has Issued a Billion Certificates by tialaramex on Thursday February 27, 2020 @04:24PM (#22438089)
Pinning can be used with anything in the chain not just your leaf.

Some pinning strategies assume a particular CA is trustworthy and pin the public key for that CA, so that they don't need to update with new pins just because they got a new certificate. Obviously you do need to stay on your toes (if you pinned Symantec and then it got distrusted... need to get new pins pronto) but that's true for any pinning strategy. Laziness plus pinning is a bad combination. Like er... keeping tigers as pets and having a toddler maybe?

[ Parent | on HN ]
Re:Let's Encrypt Has Issued a Billion Certificates by JMTQp8lwXL on Thursday February 27, 2020 @12:40PM (#22435591)
Considering 90% of websites aren't served by LE certificates, I wouldn't be surprised to hear if one of the legacy issuers had a larger market share.
[ Parent | on HN ]
Re:Let's Encrypt Has Issued a Billion Certificates by blattimwind on Thursday February 27, 2020 @12:55PM (#22435750)
> https://www.netcraft.com/images/2015/11/certauth_all.png

(January 2015)

[ Parent | on HN ]
Re:Let's Encrypt Has Issued a Billion Certificates by bluesign on Thursday February 27, 2020 @12:19PM (#22435340)
It would not work for mass data collection, maybe only on targeted attacks.
[ Parent | on HN ]