Re:Free SSL Certificate for Open Source Projects
by steven2012 on Saturday June 07, 2014 @09:10PM
(#7863636)
Free SSL certificates are completely undermining Internet security. The whole point of certs is that you have a certificate authority that verifies the identity of the person you are issuing the cert to. By giving it away for free and doing zero of the backend work, all you're doing is creating a false sense of security and poisoning the ability to trust https.
[ Parent
| on HN ]
Re:Free SSL Certificate for Open Source Projects
by Pyramids on Saturday June 07, 2014 @09:28PM
(#7863666)
As it stands, the majority of CA's do not verify any of this information, besides a very cursory email verification.
Exceptions would obviously include higher priced (OV/EV) certificates, which are no different cryptographically. Even the CA mentioned (GlobalSign) states this fairly clearly on their website.[1]
[1] https://www.globalsign.com/ssl-information-center/types-of-s...
Re:Free SSL Certificate for Open Source Projects
by akerl_ on Saturday June 07, 2014 @09:13PM
(#7863644)
Yes, because the paid cert industry has a long history of preventing people from pretending to be other entities.
Re:Free SSL Certificate for Open Source Projects
by indusface on Tuesday June 10, 2014 @02:18AM
(#7872051)
The SSL protocol uses digital certificates to create a secure, confidential communications "pipe" between two entities. Data transmitted over an SSL connection cannot be tampered with or forged without the two parties becoming immediately aware of the tampering. This Free concept is really bogus. Nothing comes free! http://www.indusface.com/index.php/products/ssl-certificates
Re:Free SSL Certificate for Open Source Projects
by iancarroll on Saturday June 07, 2014 @11:17PM
(#7863872)
So they should pay to make it more secure? It's not like you get to skip domain validation.