Slashdot Mirror
"Let's Encrypt" Project To Issue First Free Digital Certificates Next Month
An anonymous reader writes: Let's Encrypt, the project that hopes to increase the use of encryption across websites by issuing free digital certificates, is planning to issue the first ones next month. Backed by the EFF, the Mozilla Foundation, the Linux Foundation, Akamai, IdenTrust, Automattic, and Cisco, Let's Encrypt will provide free-of-charge SSL and TSL certificates to any webmaster interested in implementing HTTPS for their products. The Stack reports: "Let's Encrypt's root certificate will be cross-signed by IdenTrust, a public key CA owned by smartphone government ID card provider HID Global. Website operators are generally hesitant to use SSL/TLS certificates due to their cost. An extended validation (EV) SSL certificates can cost up to $1,000. It is also a complication for operators to set up encryption for larger web services. Let's Encrypt aims to remove these obstacles by eliminating the related costs and automating the entire process."
StartSSL has already been doing this. I believe Let's Encrypt real goal is to make the deployment and unkeep easier?
cacert.org is not trusted by Windows, OS X, Mozilla, and others where Let's Encrypt will be thanks to a crossed sign cert. cacert.org's root certificate is also using md5 still so it's unlikely that it's current root cert ever will or should be trusted. lets encrypt will do all of the work of creating and renewing certificates with the use of their command line tool.
If you're on shared hosting, you should get off ASAP. I used to have a few sites on shared hosting and we'd either a) be impacted by other users using too many resources or b) be threatened with disconnection by the host for using too many resources. The sites were small and not using that much in the way of resources, but shared hosting is tossing a thousand people into a pool and then kicking out the ones who try to swim the slightest bit. The hosts can do this because they know that there's a line of people ready to jump in to take the place of those kicked out.
Instead of going the shared hosting route, get a Virtual Private Server. It won't set you back that much. I pay $34 a month - and that's for managed hosting, unmanaged is much cheaper if you're comfortable managing the server yourself. Yes, this is more money than the $2 a month for "unlimited" space/bandwidth shared hosting, but you'll actually get what you pay for instead of being crammed together with a thousand other sites on an overloaded server.
(You could get a Dedicated Server, but these cost a lot more and only make sense for the biggest of websites. Get a VPS first and if your site grows to the point that it needs a dedicated box, then congrats.)
My sci-fi novel, Ghost Thief, is now available from Amazon.com.
Let's Encrypt, a division of Shell Company, LLC., a wholly-owned subsidiary of Totally Not The NSA, Inc.
You seem to misunderstand the purpose and nature of these certificates. While it is fun as a joke, that isn't what it is for.
These certificates never have been meant to protect against either government agencies or against employers. It has always been known by security geeks that any intermediate actor in the chain can eavesdrop and can intercept the connection. That is not what they protect against. They protect by revealing the links in the chain.
SSL is intentionally vulnerable for those implementing a MitM attack, and many businesses and schools implement this. Quite a few major networking products have simplified MitM down to the point of simply hitting a checkbox. One of the biggest corporate reasons for this is to enable caching.
SSL is absolutely vulnerable to being (eventually) deciphered by anyone who eavesdrops, and is vulnerable to being modified by any person holding a matching cert for any point on the certificate's security chain. There are many accounts that major governments already have copies of those critical points.
So what does it offer? The most immediate benefits are replay prevention and an integrity guarantee. Imagine if an attacker recorded a session of you logging into your bank and transferring funds. Without replay protection, and with no other replay protections by the bank, an attacker could replay the transaction over and over and over again, draining your bank account. Since both client and server theoretically offer unique session keys for each session they cannot be replayed. The integrity guarantee is also important, meaning that once your connection is established, those monitoring your connection cannot modify it without it being detected. The integrity guarantee is fairly weak and easily subject to MitM exploits unless properly configured with EV certificates or using two-way TLS and requiring mutual authentication. Basically you can detect all the links in the chain, but if one of those links is already compromised that isn't the protocol's fault. If someone inside your trust chain is intercepting and re-encoding your messages, the protocol won't stop it; all it will show is the person is a link in the authentication chain.
It also offers moderate degree of protection for authentication that the host you are connecting to matches who they claim to be; that is, with a TLS or SSL connection to example.com, if you know the certificate, then you have an authentication chain that the site matches. Just like the integrity guarantee, the protocol shows you all the links and nothing more. You still need to watch out for weak links. If one of the links in the certificate chain includes your corporate proxy or school's servers then you should assume that link in the chain is compromised, which is the most common MitM attack.
The protection most people think of -- the protection from eavesdropping -- is only a very weak protection and not guaranteed by the protocol. The encryption adds a cost to any eavesdroppers not part of the security chain, but for most of the encryption protocols that protection is minimally overcome with a large budget.
//TODO: Think of witty sig statement