Slashdot Mirror
Comodo Attempting to Register 'Let's Encrypt' Trademarks, And That's Not Right (letsencrypt.org)
Let's Encrypt is a nonprofit aimed at encrypting the entire web. It provides free certificates, and its service is backed by EFF, Mozilla, Cisco, Akamai and others. Despite it being around for years, security firm Comodo, which as of 2015, was the largest issuer of SSL certificates with a 33.6% market share on 6.6% of all web domains, last year in October filed for the trademark Let's Encrypt. The team at Let's Encrypt wrote in a blog post today that they have asked Comodo to abandon its "Let's Encrypt" applications, directly but it has refused to do so. The blog post adds: We've forged relationships with millions of websites and users under the name Let's Encrypt, furthering our mission to make encryption free, easy, and accessible to everyone. We've also worked hard to build our unique identity within the community and to make that identity a reliable indicator of quality. We take it very seriously when we see the potential for our users to be confused, or worse, the potential for a third party to damage the trust our users have placed in us by intentionally creating such confusion. By attempting to register trademarks for our name, Comodo is actively attempting to do just that. Update: 06/23 22:25 GMT by M :Comodo CEO has addressed the issue on company's forum (screenshot).
If you don't want somebody else to use a trademark, register it for yourself!
"[Regarding the 'cloud,'] ownership was what made America different than Russia." -- Woz
Comodo proved themselves that are not trustwordy.
'Nuff said.
And antivirus stops all viruses.
And medicines cures all illnesses.
How many MASS shootings? Much less.
How many shootings in general? Much less.
Go learn statistics, some HUNDREDS of times more shootings in the US.
Just to let them be able to defend against this attack.
PrivDog, Chomodo, hacks, and issuing certs to malware, Comodo is one company I'd steer clear from in any case.
Not surprising coming from a company that trolls other SSL Certificate Authorities and tries to steal their customers. Everytime my GoDaddy certs are up for renewal, these bitches from Comodo start calling and telling me how much money they can save me.
Who is authorized to certify the Certification Authorities, and what would it take to finally have Comodo's cert revoked?
Freedom to fear. Freedom from thought. Freedom to kill.
I guess the War on Terror really is about freedom!
Add another company to the "do not use" list...
With everything Comodo has done, or not done, that should have gotten them removed, maybe we should push to have the Comodo CA certs dropped from the products and platforms of sponsors "EFF, Mozilla, Cisco, Akamai and others".
Comodo have facebook pages, twitter, accounts, contact forms on their website and email addresses. Go and tell them what you think of this.
Never trust a man in a blue trench coat, Never drive a car when you're dead
A lawyer could argue that Comodo did have knowledge of this mark being in use elsewhere due to this link:
http://forums.comodo.com/general-security-questions-and-comments/the-eff-to-launch-lets-encrypt-certificate-authority-t108054.0.html
Surely their lawyers know that the granted mark will be invalidated within the first 30 days, so why persist? To maliciously drain money from a .org out of spite.
Drop the application. Earn a little goodwill.
And antivirus stops all viruses.
And medicines cures all illnesses.
How many MASS shootings? Much less.
How many shootings in general? Much less.
Go learn statistics, some HUNDREDS of times more shootings in the US.
More people are killed in the US by knives, as in being stabbed by a knife-wielding criminal.
Web browser makers "authorize" certificate authorities by accepting money from the CA to include their public keys in the web browser.
OS makers also can authorize CAs for code signing by including their public keys in the OS.
(I believe Java, being platform agnostic, has its own code signing methods separate from the OS it can run on)
So just convince Google (chrome), Mozilla (Firefox), and Microsoft (IE/Edge) to stop accepting Comodo's tens of thousands of dollars each year and no longer include their CA public key.
Good luck :P
Comodo only makes fake AV and malware software. Stay far, FAR away!
In the US if you use a trademark, you own the the trademark even if you haven't registered it. Since it is already being used in commerce for that mark, the application shouldn't be successful and can be challenged in the courts if it is granted.
How does that tagline sound?
Browser and OS vendors decide which CAs they trust enough to honour.
This is like the Linux trade mark wars all over again. There's always some sleazy company trying to benefit from people's good will.
-SR
More people are killed in the US by knives, as in being stabbed by a knife-wielding criminal.
How many of those cases were considered mass knifings where four or more people selected indiscriminately, not including the perpetrator, were killed?
Freedom to fear. Freedom from thought. Freedom to kill.
I guess the War on Terror really is about freedom!
Who is authorized to certify the Certification Authorities,
The software provider that provided the list of root certificate that your browser uses. /etc/ssl/certs or /var/lib/ca-certificates/pem) ...or your browser's provider.
Depending on your setup, it's either your OS provider...
(e.g.:
- Windows has a list of root certificates that are considered legit.
- Most Linux distribution also pack such a list some where in
(e.g.:
- Firefox comes with its own list of root certificates)
and what would it take to finally have Comodo's cert revoked?
If the software provider decides that Comodo is not trustworthy, all of the above players can push an update and not include its certificate in the new updated list.
(e.g.: Microsoft periodically pushes a security update called "Root Certificates".
And sometimes, on some new versions, Firefox ships with a new modified list)
This has happened already with some of China's certificate which were used in MITM attack to spy on their citizens.
Firefox has also a faster way to directly issue warnings and potential revocation without even waiting for an update. (OneCRL)
I have no idea about edge.
I suspect that chrome has some similar approach, which probably require you to pipe every single visited URL to some cloud processing server to attest if safe or not.
"Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]
Someone needs to show paying Comodo customers how to use Let's Encrypt to renew their certs for free.
I think that's the reason why Comodo is trying to own the Let's Encrypt name....
"Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]
Is knifing four or more people in one incident worse than knifing one person in each of four incidents? If so, why? If not, why do you draw a distinction?
Chuuch. Preach. Tabernacle.
Moxie Marlinspike tells a story about Comodo at BlackHat 2011
The bit at 8m22 is priceless.
Comodo founder:
The hacker turns out to be a script-kiddie who got the technique from an introductory hacking video.
Comodo continues to embarrass themselves as the story unfolds, with their CEO finally complaining that all this wouldn't be a problem if man-in-the-middle wasn't possible. Huh? Aren't you in the business of selling the solution to the MITM problem?
You. You have (probably by default) configured your computer to trust them. Look in /etc/ssl/certs. You trust everything in there.
rm /etc/ssl/certs/Comodo*.pem to fix the problem.
It can't be reasoned with, it doesn't feel pity, or remorse, or empahty. And it absolutely will not stop, ever, until your natural right to self defense is dead.
How is it that they haven't had their issuer's license revoked already? They've already been found wanting as a cert provider, since they seem to have no qualms about issuing fraudulent certificates.
And now they're trying to fraudulently use someone else's trademark?
How much more fraud will they be allowed to perform before someone gives them a serious slap?
Oh, wait, what am I thinking... This is the US. As long as their shareholders are happy they could rape, pillage and burn entire towns and no one would care.
.
This Let's Encrypt fiasco is just another example of how low Comodo's business practices really are.
How much is a Comodo certificate worth if enough people ban the Comodo root certificate from their computers? You want to play hard ball, Comodo? Careful what you wish for.
... the difference between a trademark and a copyright. They obviously speak and write English as a second language, and they are obsessed with the number 90 as if 90 days has never been used by anyone before as an approximation for three calendar months or one quarter year in any business context.
Drop Comodo CA from Firefox should be a very strong deterrent.
They're shipped by various software makers. All that has to happen is that people choose other certs. You can remove Comodo from your own systems in most software, though you may have to look at many places (Windows cert store, Mozilla's cert store, Java's cert store, etc.) at the cost of breaking a lot of things.
There is a 'death penalty' that could be invoked. It's not something they use lightly, though, but at this point, I'm sort of surprised Comodo is still trusted...
Yes, it would likely stop a lot of shootings, but obviously not all of them.
Murder rate US: 3.9 / 100k
There is only one place worse in the EU: Lithuania with a whopping 5.5 / 100k, on average the EU is a lot less than the US.
Taking the listed countries you end up with the following.
Austria: 0.5
Belgium: 1.8
France 1.2
UK 1.0
Germany: 0.9
All which are significantly lower than the average of the US.
"Civis Europaeus sum!"
Given how unprincipled /. moderators are (see any thread about whether a /. moderator will pay to see the next Star Wars movie and keep in mind Disney's behavior on DRM and copyright term extension, for instance), I'd say you're sadly in the minority. Cases like this are ample reason to refuse to do business with organizations that treat us badly, but /. moderators became far more concerned with convenience at any price.
Digital Citizen
Can Comodo register a trademark on a phrase that the non-profit "Let's Encrypt!" has copyrighted?
I actually didn't really want to read too deeply into this when the article first came up. I figured it could be a thorny issue and that maybe Comodo had previously used "Let's Encrypt" in marketing somewhere prior to the free campaign. Then I read their CEO's statement, and it's pretty clear that he just plain feels threatened and he acts as if he invented the concept of a 90-day free trial. I can certainly see where he could be losing money; but I guess as an onlooker, if someone can come along and take your money that way, your position was pretty weak in the first place.
So I guess I'd say I now feel that attempting to register this trademark seems pretty abusive, and the person who convinced me of that was Comodo's CEO in his post on his company's forums.
After reading the post by Comodo's "leader," I'd suggest that Comodo abandon "Let's Encrypt" before a court shames them. If the jackass wants a trademark, I'd suggest he try to register "90."
PrivDog, Chomodo, hacks, and issuing certs to malware, Comodo is one company I'd steer clear from in any case.
Shit, Namecheap still uses them for their resold SSL certs. If Namecheap doesn't have another option next time I need to renew one, I'm going elsewhere. That would be a pain, but I'm officially done with Comodo after this - seven strikes and I'm stupid for not calling you out on three.
My God, it's Full of Source!
OUTSIDE_IP=$(dig +short my.ip @outsideip.net)
First time you've tried alcohol?
ISRG can file its own application for the trademark, as well as submit a complaint to the USPTO that Comodo's request should not be granted.
Its like a piece of art. Let's Encrypt made their art, put it out there, and then came along the bully trying to steal the art of the project Let's Encrypt. The question here is, if someone else made the art and Comodo had nothing to do with it, how could they come in and claim ownership of some part of the art? Under the 1st amendment someone else made that art. Should we not honor the ownership and creator of that art? Should we not have a mechanism to stop Comodo from attempting to steal ownership of the art?
Now the CEO had a funny comment about how Lets Encrypt was copying Comodo's business model of 90 day free certs but, really that's not the case. When you create a product you tend to try to make one that is comparable or better to existing products in this case they matched their competitors product so as to avoid not creating a deliberately inferior product people wouldn't want.
obamasweapon.com
Who is authorized to certify the Certification Authorities, and what would it take to finally have Comodo's cert revoked?
In your software and/or browsers, you are the ultimate authority. Don't like Comodo? Remove their root cert from your trust store.
'The tyrant will always find pretext for his tyranny.' - Aesop's Fables
Where are the hackers when you need them? The ultimate payback would be to file a trademark for the private key sequence of Comodo's root signing certificate.
Browser vendors don't get paid by CAs. If you have evidence that they get tens of thousands of dollars a year from Comodo, present it.
I've used Comodo's firewall for years. I have now removed it from all but one computer, which I don't use all that much anymore. When I am assured that Comodo has, in fact, abandoned its efforts to steal "Let's Encrypt", I'll go back. I like their firewall, and it will hurt to go through all the little adjustments that get the replacement (Kaspersky Internet Security) working exactly the way I like.
I've calculated my velocity with such exquisite precision that I have no idea where I am.
Have been using Comodo, but NEVER EVER AGAIN.
Some stats from the CEO's first post:
Free SSL: mentioned 9 times, 7 of them in one paragraph;
Comodo: only 3 times
Seems they should leave Let's Encrypt alone and go with Free SSL instead.
If you dont like Comodo, remove their CA certs from your machine.
I'm doing it just to see how it goes:
root:/etc/ssl/certs # tar zcvf douches.tgz `ls | grep -i comodo` && rm `ls | grep -i comodo`
Comodo_AAA_Services_root.pem
COMODO_Certification_Authority.pem
COMODO_ECC_Certification_Authority.pem
COMODO_RSA_Certification_Authority.pem
Comodo_Secure_Services_root.pem
Comodo_Trusted_Services_root.pem
Actually, I'm just tarring them up in case for some reason I do need them back.
Browser vendors don't get paid by CAs.
I just read Mozilla's CA inclusion policy, and you appear correct. The browser maker doesn't get paid; the auditing firm "with access to the details of the subordinate CA’s internal operations" gets paid.
Before they sold to Activision, King.com tried to register trademarks on the words CANDY and SAGA. So not only is this, wrong, it's copycat.
Originally (by Sextus Empiricus, translated from Greek): Est mola tarda dei, verum molit illa minutim. "Is millstone late God's, but grinds she finely."