crapsalot

Re:Ask HN: Is Let's Encrypt Harmful? on Thursday January 14, 2016 @08:58PM (#10906554)

2. Should I trust domains with Let's Encrypt-issued certificate less than those with paid certificates with identity validation?

No...

Lets Encrypt should not have the same level of trust as the basic DV level cert from a standard CA.

There is a security hole in ACME which is glossed over with handwaving from the fanbois.

Re:Ask HN: Is Let's Encrypt Harmful? on Thursday January 14, 2016 @08:56PM (#10906542)

Wrong.

Most SSL cert CA's check DNS for email addresses and only validate DNS entries.

Lets Encrypt only checks DNS for IP addresses and issues certs based on root access to the IP addresses.

A CA DV is not equivalent to a Lets Encrypt cert.

Lets Encrypt Is Insecure

Posted by crapsalot on Thursday January 14, 2016 @08:48PM
from the self-post dept.

Lets Encrypt has recently been the target of a few news stories. A brief review of Lets Encrypt documentation highlights the basic problem with Lets Encrypt is a reliance on the ACME protocol's gaping security hole of equating DNS A record server IP addresses with domain ownership.It's very clear that if a domain has a wildcard host record that Lets Encrypt will automatically enable any root...

( Read More... | 2 comments | 2 points | on HN )