Slashdot Mirror
Comodo Attempting to Register 'Let's Encrypt' Trademarks, And That's Not Right (letsencrypt.org)
Let's Encrypt is a nonprofit aimed at encrypting the entire web. It provides free certificates, and its service is backed by EFF, Mozilla, Cisco, Akamai and others. Despite it being around for years, security firm Comodo, which as of 2015, was the largest issuer of SSL certificates with a 33.6% market share on 6.6% of all web domains, last year in October filed for the trademark Let's Encrypt. The team at Let's Encrypt wrote in a blog post today that they have asked Comodo to abandon its "Let's Encrypt" applications, directly but it has refused to do so. The blog post adds: We've forged relationships with millions of websites and users under the name Let's Encrypt, furthering our mission to make encryption free, easy, and accessible to everyone. We've also worked hard to build our unique identity within the community and to make that identity a reliable indicator of quality. We take it very seriously when we see the potential for our users to be confused, or worse, the potential for a third party to damage the trust our users have placed in us by intentionally creating such confusion. By attempting to register trademarks for our name, Comodo is actively attempting to do just that. Update: 06/23 22:25 GMT by M :Comodo CEO has addressed the issue on company's forum (screenshot).
If you don't want somebody else to use a trademark, register it for yourself!
"[Regarding the 'cloud,'] ownership was what made America different than Russia." -- Woz
Comodo proved themselves that are not trustwordy.
And antivirus stops all viruses.
And medicines cures all illnesses.
How many MASS shootings? Much less.
How many shootings in general? Much less.
Go learn statistics, some HUNDREDS of times more shootings in the US.
PrivDog, Chomodo, hacks, and issuing certs to malware, Comodo is one company I'd steer clear from in any case.
Who is authorized to certify the Certification Authorities, and what would it take to finally have Comodo's cert revoked?
Freedom to fear. Freedom from thought. Freedom to kill.
I guess the War on Terror really is about freedom!
With everything Comodo has done, or not done, that should have gotten them removed, maybe we should push to have the Comodo CA certs dropped from the products and platforms of sponsors "EFF, Mozilla, Cisco, Akamai and others".
Comodo have facebook pages, twitter, accounts, contact forms on their website and email addresses. Go and tell them what you think of this.
Never trust a man in a blue trench coat, Never drive a car when you're dead
Not surprising coming from a company that trolls other SSL Certificate Authorities and tries to steal their customers. Everytime my GoDaddy certs are up for renewal, these bitches from Comodo start calling and telling me how much money they can save me.
That's nothing, they called me and tried to get me to switch away from their own resellers.
Web browser makers "authorize" certificate authorities by accepting money from the CA to include their public keys in the web browser.
OS makers also can authorize CAs for code signing by including their public keys in the OS.
(I believe Java, being platform agnostic, has its own code signing methods separate from the OS it can run on)
So just convince Google (chrome), Mozilla (Firefox), and Microsoft (IE/Edge) to stop accepting Comodo's tens of thousands of dollars each year and no longer include their CA public key.
Good luck :P
In the US if you use a trademark, you own the the trademark even if you haven't registered it. Since it is already being used in commerce for that mark, the application shouldn't be successful and can be challenged in the courts if it is granted.
How does that tagline sound?
This is like the Linux trade mark wars all over again. There's always some sleazy company trying to benefit from people's good will.
-SR
Who is authorized to certify the Certification Authorities,
The software provider that provided the list of root certificate that your browser uses. /etc/ssl/certs or /var/lib/ca-certificates/pem) ...or your browser's provider.
Depending on your setup, it's either your OS provider...
(e.g.:
- Windows has a list of root certificates that are considered legit.
- Most Linux distribution also pack such a list some where in
(e.g.:
- Firefox comes with its own list of root certificates)
and what would it take to finally have Comodo's cert revoked?
If the software provider decides that Comodo is not trustworthy, all of the above players can push an update and not include its certificate in the new updated list.
(e.g.: Microsoft periodically pushes a security update called "Root Certificates".
And sometimes, on some new versions, Firefox ships with a new modified list)
This has happened already with some of China's certificate which were used in MITM attack to spy on their citizens.
Firefox has also a faster way to directly issue warnings and potential revocation without even waiting for an update. (OneCRL)
I have no idea about edge.
I suspect that chrome has some similar approach, which probably require you to pipe every single visited URL to some cloud processing server to attest if safe or not.
"Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]
Someone needs to show paying Comodo customers how to use Let's Encrypt to renew their certs for free.
I think that's the reason why Comodo is trying to own the Let's Encrypt name....
"Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]
Is knifing four or more people in one incident worse than knifing one person in each of four incidents? If so, why? If not, why do you draw a distinction?
Chuuch. Preach. Tabernacle.
Moxie Marlinspike tells a story about Comodo at BlackHat 2011
The bit at 8m22 is priceless.
Comodo founder:
The hacker turns out to be a script-kiddie who got the technique from an introductory hacking video.
Comodo continues to embarrass themselves as the story unfolds, with their CEO finally complaining that all this wouldn't be a problem if man-in-the-middle wasn't possible. Huh? Aren't you in the business of selling the solution to the MITM problem?
How is it that they haven't had their issuer's license revoked already? They've already been found wanting as a cert provider, since they seem to have no qualms about issuing fraudulent certificates.
And now they're trying to fraudulently use someone else's trademark?
How much more fraud will they be allowed to perform before someone gives them a serious slap?
Oh, wait, what am I thinking... This is the US. As long as their shareholders are happy they could rape, pillage and burn entire towns and no one would care.
.
This Let's Encrypt fiasco is just another example of how low Comodo's business practices really are.
Yes, it would likely stop a lot of shootings, but obviously not all of them.
Murder rate US: 3.9 / 100k
There is only one place worse in the EU: Lithuania with a whopping 5.5 / 100k, on average the EU is a lot less than the US.
Taking the listed countries you end up with the following.
Austria: 0.5
Belgium: 1.8
France 1.2
UK 1.0
Germany: 0.9
All which are significantly lower than the average of the US.
"Civis Europaeus sum!"
Given how unprincipled /. moderators are (see any thread about whether a /. moderator will pay to see the next Star Wars movie and keep in mind Disney's behavior on DRM and copyright term extension, for instance), I'd say you're sadly in the minority. Cases like this are ample reason to refuse to do business with organizations that treat us badly, but /. moderators became far more concerned with convenience at any price.
Digital Citizen
I actually didn't really want to read too deeply into this when the article first came up. I figured it could be a thorny issue and that maybe Comodo had previously used "Let's Encrypt" in marketing somewhere prior to the free campaign. Then I read their CEO's statement, and it's pretty clear that he just plain feels threatened and he acts as if he invented the concept of a 90-day free trial. I can certainly see where he could be losing money; but I guess as an onlooker, if someone can come along and take your money that way, your position was pretty weak in the first place.
So I guess I'd say I now feel that attempting to register this trademark seems pretty abusive, and the person who convinced me of that was Comodo's CEO in his post on his company's forums.
After reading the post by Comodo's "leader," I'd suggest that Comodo abandon "Let's Encrypt" before a court shames them. If the jackass wants a trademark, I'd suggest he try to register "90."
PrivDog, Chomodo, hacks, and issuing certs to malware, Comodo is one company I'd steer clear from in any case.
Shit, Namecheap still uses them for their resold SSL certs. If Namecheap doesn't have another option next time I need to renew one, I'm going elsewhere. That would be a pain, but I'm officially done with Comodo after this - seven strikes and I'm stupid for not calling you out on three.
My God, it's Full of Source!
OUTSIDE_IP=$(dig +short my.ip @outsideip.net)
Its like a piece of art. Let's Encrypt made their art, put it out there, and then came along the bully trying to steal the art of the project Let's Encrypt. The question here is, if someone else made the art and Comodo had nothing to do with it, how could they come in and claim ownership of some part of the art? Under the 1st amendment someone else made that art. Should we not honor the ownership and creator of that art? Should we not have a mechanism to stop Comodo from attempting to steal ownership of the art?
Now the CEO had a funny comment about how Lets Encrypt was copying Comodo's business model of 90 day free certs but, really that's not the case. When you create a product you tend to try to make one that is comparable or better to existing products in this case they matched their competitors product so as to avoid not creating a deliberately inferior product people wouldn't want.
obamasweapon.com
Who is authorized to certify the Certification Authorities, and what would it take to finally have Comodo's cert revoked?
In your software and/or browsers, you are the ultimate authority. Don't like Comodo? Remove their root cert from your trust store.
'The tyrant will always find pretext for his tyranny.' - Aesop's Fables
Browser vendors don't get paid by CAs. If you have evidence that they get tens of thousands of dollars a year from Comodo, present it.
I've used Comodo's firewall for years. I have now removed it from all but one computer, which I don't use all that much anymore. When I am assured that Comodo has, in fact, abandoned its efforts to steal "Let's Encrypt", I'll go back. I like their firewall, and it will hurt to go through all the little adjustments that get the replacement (Kaspersky Internet Security) working exactly the way I like.
I've calculated my velocity with such exquisite precision that I have no idea where I am.
Some stats from the CEO's first post:
Free SSL: mentioned 9 times, 7 of them in one paragraph;
Comodo: only 3 times
Seems they should leave Let's Encrypt alone and go with Free SSL instead.
Agreed, they just called one of my employees 2 days ago. He was like "Comodo is calling about XYZ.com's cert expiring, we need to renew it" and I was like "That's cute, we buy our certs from GoDaddy." Then he was like yeah, but they are cheaper, 5 years for $499 and I was like "That's interesting, 39 months is the max time a cert can be issued for since 2015, tell them to go pound sand." Seriously, Comodo can go die in a fire. They even tried to tell him that we are getting our GoDaddy certs from Microsoft (as if it's a bad thing, we're an Azure shop using Microsoft technologies for everything we do, despite as far as I know it being a completely false statement). *shrugs*
Browser vendors don't get paid by CAs.
I just read Mozilla's CA inclusion policy, and you appear correct. The browser maker doesn't get paid; the auditing firm "with access to the details of the subordinate CA’s internal operations" gets paid.