Draft Let's Encrypt Subscriber Agreement

Re:Draft Let's Encrypt Subscriber Agreement by UnoriginalGuy on Thursday May 21, 2015 @03:20PM (#9584847)

What if someone hijacks a domain? Should they issue one then?

I'll say this, I don't want to see "Let's Encrypt" go on some moral crusade deciding not to grant a certificate to a website because that website contains offensive content, but their job is to verify at least somewhat the identity of the requester to try and stem impersonation.

[ Parent | on HN ]

Re:Draft Let's Encrypt Subscriber Agreement by the8472 on Thursday May 21, 2015 @03:23PM (#9584873)

> What if someone hijacks a domain?

But that's a registrar problem, not a "proof that this connection comes from someone who controls that domain" problem. These aren't EV certificates.

[ Parent | on HN ]

Re:Draft Let's Encrypt Subscriber Agreement by _cpancake on Thursday May 21, 2015 @10:32PM (#9586380)

Part of HTTPS is making sure that the person you're talking to is the person you think you're talking to.

[ Parent | on HN ]

Re:Draft Let's Encrypt Subscriber Agreement by the8472 on Friday May 22, 2015 @04:50AM (#9587182)

That's what EV certificates are for.

Otherwise https only gurantees that you're actually talking to the domain you see in the URL, not who that domain belongs to.

[ Parent | on HN ]

Re:Draft Let's Encrypt Subscriber Agreement by tedunangst on Thursday May 21, 2015 @05:15PM (#9585425)

The fact that I seized a domain ten years ago doesn't mean I'm not who I say I am today.

Also, seizure and hijacking aren't equivalent.

[ Parent | on HN ]