I'm of the opinion that the vista and windows 8 problems were caused by Microsoft caving in to orgs and loud individuals that were too invested in legacy software. People expected 20 year old software packages to work without errors and that is, frankly, fucking dumb.
General purpose operating systems are a mature industry. Regardless of your personal beliefs there is already great and increasing value in compatibility especially as ROI related to incremental increasingly hard won OS and hardware improvements tank. Markets will only accept disruptive change when there is a corresponding provision of new value to make up for their trouble.
Too much legacy shit means that windows never changes and old systemic problems don't get solved.
It's a false choice to assume one must necessarily suffer at the hand of the other. Proper planning prevents piss poor performance. One could elect to take steps to architect systems to account for and manage change up front. It is entirely possible to retain compatibility while enabling flexibility to address the future.
Nobody expects their big linux distro to work that way. Or their Mac to work that way. Why is Microsoft the exception?
I do, Linus does. Try sending in a patch that breaks Linux ABI and see what happens to it/you.
Nobody knows what spying is happening, but the thing talks to the 'net so it obviously must be doing something unconscionable.
No need for conjecturbation. My conclusion Windows is spyware is based upon Microsoft's own documentation and privacy agreements.
there was also chatter about it being a file sniffer and keylogger, but that was debunked pretty hard.
Someone should tell Microsoft that debunked nonsense is still posted to their website. Some excerpts:
"If you turn on Speech, inking, & typing, we collect samples of your typing and handwriting info to improve our dictionaries and handwriting recognition for everybody who uses Windows"
"âAbility to run a limited, pre-approved list of Microsoft certified diagnostic tools, such as msinfo32.exe, powercfg.exe, and dxdiag.exe.
âAbility to get registry keys.
âAbility to gather user content, such as documents, if they might have been the trigger for the issue."
There's a short list of software that Windows 10 upgrades disable once at upgrade time, which lead people to conjecture that Microsoft gets a list of all third-party software you use continuously.
It's all on their website. Telemetry provides app usage data which is defined by Microsoft as:
"Includes how an app is used, including how long an app is used, when the app has focus, and when the app is started"
So far, nobody's clearly and definitively defined the spying; usually, when pressed, they give up
Personally I leave privacy statements, EULA and telemetry documentation Microsoft publishes speak for themselves.
arguing the conspiracy theories and say something about encrypted connections making it hard to identify what's being leaked, but that it must be something important if encryption is being used.
A conspiracy theory would be Microsoft installs Windows 10 when you dismiss the upgrade prompt. Microsoft collects information about the software you use. Or Microsoft has remote access facilities baked into windows that allow Microsoft to access configuration and content of individual systems without explicit consent or notification. These are all baseless conspiracy theories completely unsupported by documentation provided by Microsoft.
Just hearing the word "experience" in an entertainment context makes me gag.
A few months ago I purchased a rollercoaster simulator.
Fired up and loaded one of thousands of coasters you can download off the net... it showed a rolling...coaster with neat 3D graphics on my screen.. No shooting zombies or dodging alien death rays... just a car on a fixed track you have no control over. Boring...as... f***.... very same software/w Rift.
Rift is the difference between watching something on a screen and being somewhere else. It's a hoot... so much so I don't waste my time with "flat games" anymore. Too painful... like going back to an Atari 2600 after having a NES.
3DTV is watching the same TV only with a stereo vision effect. An effect that drops off after a few meters IRL anyway and has never been a dominant means of judging scale and distance.. Nice but no big deal.
an expensive and largely useless toy that really only irrationally exuberant developers and people with more money than common sense will buy.
Look up Jewelers and new car dealerships in your local yellow pages.
These things now make calls just by anonymous voice commands? Really? This is a massively irresponsible design. Even telephone number hyperlinks on websites require manual confirmation prior to dialing. Now anyone can create a website that plays call x, y and z to get your victim into trouble, stalk victims and or rack up toll charges or do the same via TV/radio broadcast.
They know it's dumb. They just can't help themselves.
If you've loved the last two decades of comically insecure Flash players and PDF readers your going to love the future where anyone's systems can now be owned by closed source adobe CDM modules.
Yup. People act like a decreasing population is a disaster, but the reverse true. Put bluntly there are too many people on this planet
Sustainable carrying capacity of the planet is not static.
Single individuals in industrialized countries consume the resources of dozens of people in poor countries.
Production, management and availability of technology and resources dominate outcomes much more so than counts of living humans.
either reduce our population, as Japan is doing, or suffer the consequences (see India, Africa etc).
Or you can spend 30 seconds thumbing through lists of countries by actual population density and realize the premise of this argument does not hold up.
Japan is living proof that this can be done in comfortably, despite the dire warnings from economists and politicians with an investment in the perpetual growth con.
Japan "comfortably" has the worlds highest debt load by percentage of GDP.
Tell them you won't visit their sites anymore if they continue to facilitate Facebook's or Google's or anyone else's cross-site cyber stalking.
If your going to sue anyone consider directing your legal efforts at site owners for facilitating cyber stalking. Don't waste your time with Facebook.
Contribute to public awareness campaigns that equate Facebook logos on websites with eye of Sauron in the minds of users. The thing cyber stalking firms fear most is sunlight... an informed public knowing they are being stalked everywhere you go by nameless creepers enmasse.
If there is a price to be paid even a small one site may think twice before cut and pasting bug code especially where the same or very similar goals can be achieved without enabling Facebook stalking.
Let domain registrars handle it, so they can charge $99 a year for a secure certificate? That artificial barrier to entry and clear predation of consumers is precisely why Let's Encrypt was formed. A commercial CA doesn't give a fuck what happens to you as long as you paid for the cert.
My belief is one or both of the following must happen:
1. Domain registrars should be required to assign certs automatically as standard part of domain ownership or everyone should just drop the current system and switch to DANE. Registrars must not be allowed to treat it separately as an "add-on".
2. Domain registrars should be required to provide domain owners authorization tokens consumed by CAs and other entities to securely provide proof of ownership/control to existing DV CA's and or LE for verification purposes.
I would very much prefer to see the current system burn to the ground and replaced entirely with DANE. There is significant negative value in the existence of CAs performing automated DV.
The CA is not verifying that you are not doing anything bad, just that you control the web server. The same is true for LetsEncrypt certificates.
If this were true there would be no problem. Unfortunately the assumption CA is verifying administrative control over a web server is provably false.
The entire point of having CAs issue public key is prevention of MITM attack from those with access to packets to and from a victims network.
HTTP traffic from any web server is trivially vulnerable to MITM attack. If I can access Internet traffic from my victims network I can go to any DV CA on the planet using completely automated means have a CA assign me a key I can then leverage with impunity to MITM my victim without detection from that point forward.
This isn't what I would call security nor is it necessary or defensible. It's simply terrible and idiotic.
So if some bad guy can register any domain, and put up a website, they can purchase a cert that is trusted by your browser.
For their own domains, not someone else's.
How can you TRUST that this website is not bad
Passing judgment as to the disposition of a site isn't the point of DV certs. The only thing DV certs are supposed to do is make sure those with administrative control over a domain are the same people who have administrative control over the issued cert. The problem is automated verification procedures currently widely deployed are wholly incapable of making such determinations.
Personally I would be more concerned with exfiltration than deletion but if MS wants to provide safety they should consider versioning file system so that designated folders can be rolled back to prior states no matter what happened to the data. Not all fail is intentional and this could provide useful value beyond attack resistance.
Aspect based access control mechanisms have a tendency of subverting themselves in the name of convenience over time. First there was the windows firewall, then every app installed makes exceptions for itself and before you know it firewall may as well no longer exist.
I'm not sure how they could even implement such a thing in a meaningful way. What prevents an attacker from overwriting the application and then proceeding to encrypt files or suffering large numbers of false positives as apps are updated resulting in error fatigue and rendering "notification" useless.
This could be done by running apps in isolated containers and assigning access rights to shared stores to the container rather than the software. This is what windows should be doing to meaningfully improve secure wherever it can possibly get away with it.
We could have had that.but DANE is worthless without DNSSEC and everyone is too lazy to implement DNSSEC.
DNSSEC should not be deployed until DNS amplification countermeasures are fully deployed. This can be RFC7873, TCP, (D)TLS... I don't care which... To go ahead with deployment of DNSSEC knowing DNS infrastructure will be leveraged to launch massive DDOS attacks is massively irresponsible.
For an attacker to initiate the process and successfully complete the validation, they would either need control of the server (or be able to impersonate it), or control of the authoritative DNS records.
The assumption here is that it would be difficult to MITM LE themselves when doing authoritative DNS lookups.
You don't have to MITM LE's infrastructure. All that is needed is to MITM your victim's wire which may well include DNS traffic toward their (authoritative) DNS server.
Sounds like your problem isn't with Lets Encrypt, it's with the entire concept of issuing encryption certificates, regardless of issuer.
My problem is with lets encrypt and every other CA automatically issuing certs using methods they know damn well to be completely insecure subject to the very same forms of attack certificates being issued are intended to prevent. It's a breathtakingly idiotic and dangerous practice.
I don't have a problem with the underlying technology. PKI is awesome when deployed properly. When deployed with the level of fail LE and other DV CA's are currently bringing to the table you damn well better believe I have a problem with it.
The sad part in all of this is that it's also pointless and trivially remedied. The domain registrars are the ones who should be handing out domain certs as they already have relationships with domain owners. At the very least registrars could be providing authorization tokens to be consumed by third party CAs. There is no excuse for current behavior and practices.
Not quite -- the client generated a private-public key pair when it first contacted LE, communications between the client and LE are encrypted, and the client answering the challenge is required to sign a nonce provided by LE using their private key. The MITM near the server side of the connection does not have the private key, and so cannot read what the challenge value should be, and cannot sign the nonce.
Are you referring to a legitimate domain owners client or an attackers client?
Trust whom, the site owner? LE? Their CA? If you don't trust root CA, then you are SOL. Better unplug your computer.
My remarks are limited to establishing domain ownership.
Ownership of what, the hostname? The client requesting the certificate has to satisfy a challenge, for example placing a file with specific contents at a specific location controlled by the hostname, or populating a specific DNS record with a specific value for that hostname's zone. If the client is able to satisfy those challenges, then it already has complete control over the hostname and the content it serves.
DNS is insecure. HTTP is insecure. The routing infrastructure of the Internet itself (BGP et al) is insecure.
Both DNS and HTTP are subject to trivial MITM attack by anyone with access to a victims wires.
If the answer is it depends on responses from any of these protocols then one might as well implement RFC3514 and roll out a mission accomplished banner.
How does it demonstrate that? Can you explain specifically what makes this better than self-signed certs? What is the basis of trust used to establish ownership? What prevents an attacker with access to a victims wires from using LE to obtain fraudulent certificates?
Public key cryptography. The client has to satisfy both the domain control challenge, and sign a nonce provided by the CA. The domain control challenge establishes control over the domain. The signed nonce provides client identity verification.
This isn't about the basics of PKI it's the basics of establishing TRUST that's the heart of my question regarding LE.
The basis of any secure system is TRUST not alphabet soups of cryptographic jargon. It's asking the basic question "WHY SHOULD I TRUST YOU?" and receiving a reasonable, verifiable response.
How does LE vet ownership to even assign certificates in the first place? What makes this process secure and trustworthy? If there is no good answer to that question all the cryptography in the world means nothing.
They're a little better in that the fact that they come from a cert authority gives you some assurance that you're not being MITM'd. But it has always been stupid that browsers treat an HTTPS connection with a self-signed cert differently to an HTTP connection.
All lets encrypt does is move the point of MITM vulnerability from establishing a connection to obtaining the cert. A functionally equivalent MITM opportunity to untrusted self-signed certs persist regardless.
The fact that end users see a padlock icon in their browser and *assume* their connections are secure when in fact there is no rational basis for such a belief is a far worse reality than doing nothing.
My own view is that ALL DV CA's including LE should be shuttered immediately. All responsibly transferred to domain registrars who already have relationships established with domain owners. Current system is nonsensical, redundant, dangerous and completely unnecessary.
Also, unlike self-signed certs it demonstrates that the person requesting the cert has control over the hostname(s), which is pretty much all I ever had to do when I paid for a non-EV certificate.
How does it demonstrate that? Can you explain specifically what makes this better than self-signed certs? What is the basis of trust used to establish ownership? What prevents an attacker with access to a victims wires from using LE to obtain fraudulent certificates?
Yeah, how can the disabled be so selfish as to demand equal opportunities!
Life isn't equal. People are not equal. There is no such thing as an equal opportunity that does not involve taking. Demanding others take a course of action to accommodate you at their own expense is inherently a selfish act.
There are limits to human generosity.. to how far people individually and by extension as a society are willing to go out of their way to accommodate others. Rampant abuse of ADA by lawyers is only making things worse for the disabled by pushing public sentiment in the wrong direction chipping away at legitimacy of ADA itself.
Voices of the disadvantaged seeking help are being drowned out by an emerging industry of assholes gaming the system with an objective function of self enrichment. The rate of increase of ADA lawsuits is both comical and unsustainable.
People who stand up for the disabled are DICKS! Yeah!
Many of them are in fact dicks suing people with the sole intention of helping themselves to other peoples money rather than helping other people. I'll leave the insane trend line of ADA suits speak for itself.
There is now such a sprawling population of dicks looking to cash out on ADA suits I now assume anyone filing ADA suit is a dick until evidence is presented to the contrary. It's much easier that way. The default assumption is way more often to be right than wrong.
Let's not bullshit or pretend that being "techie" makes it somehow better. Malware = terrorism. And yes, that swings both ways.
Behind every act of terrorism there is political demands to enforce rules backed by threat of violence from an external entity challenging a states monopoly on violence.
Malware is generally just another criminal commercial money making enterprise. Whether it's a group of poor Canadian crackers looking to enrich themselves or multi-national corporations (e.g. Microsoft) profiting off distribution of malware.. it may be illegal or immoral yet without the political demands it is not terrorism.
It seems insane that the Royal Navy & BAE systems couldn't figure this out themselves. This has the smell of a kickback based sales agreement to me. Almost any other operating system is a better choice simply because they are smaller attack targets than any version of Windows.
When your adversaries are other nations security by obscurity is especially inoperative.
Slashdot Mirror
I'm of the opinion that the vista and windows 8 problems were caused by Microsoft caving in to orgs and loud individuals that were too invested in legacy software. People expected 20 year old software packages to work without errors and that is, frankly, fucking dumb.
General purpose operating systems are a mature industry. Regardless of your personal beliefs there is already great and increasing value in compatibility especially as ROI related to incremental increasingly hard won OS and hardware improvements tank. Markets will only accept disruptive change when there is a corresponding provision of new value to make up for their trouble.
Too much legacy shit means that windows never changes and old systemic problems don't get solved.
It's a false choice to assume one must necessarily suffer at the hand of the other. Proper planning prevents piss poor performance. One could elect to take steps to architect systems to account for and manage change up front. It is entirely possible to retain compatibility while enabling flexibility to address the future.
Nobody expects their big linux distro to work that way. Or their Mac to work that way. Why is Microsoft the exception?
I do, Linus does. Try sending in a patch that breaks Linux ABI and see what happens to it/you.
Nobody knows what spying is happening, but the thing talks to the 'net so it obviously must be doing something unconscionable.
No need for conjecturbation. My conclusion Windows is spyware is based upon Microsoft's own documentation and privacy agreements.
there was also chatter about it being a file sniffer and keylogger, but that was debunked pretty hard.
Someone should tell Microsoft that debunked nonsense is still posted to their website. Some excerpts:
"If you turn on Speech, inking, & typing, we collect samples of your typing and handwriting info to improve our dictionaries and handwriting recognition for everybody who uses Windows"
"âAbility to run a limited, pre-approved list of Microsoft certified diagnostic tools, such as msinfo32.exe, powercfg.exe, and dxdiag.exe.
âAbility to get registry keys.
âAbility to gather user content, such as documents, if they might have been the trigger for the issue."
There's a short list of software that Windows 10 upgrades disable once at upgrade time, which lead people to conjecture that Microsoft gets a list of all third-party software you use continuously.
It's all on their website. Telemetry provides app usage data which is defined by Microsoft as:
"Includes how an app is used, including how long an app is used, when the app has focus, and when the app is started"
So far, nobody's clearly and definitively defined the spying; usually, when pressed, they give up
Personally I leave privacy statements, EULA and telemetry documentation Microsoft publishes speak for themselves.
arguing the conspiracy theories and say something about encrypted connections making it hard to identify what's being leaked, but that it must be something important if encryption is being used.
A conspiracy theory would be Microsoft installs Windows 10 when you dismiss the upgrade prompt. Microsoft collects information about the software you use. Or Microsoft has remote access facilities baked into windows that allow Microsoft to access configuration and content of individual systems without explicit consent or notification. These are all baseless conspiracy theories completely unsupported by documentation provided by Microsoft.
Just hearing the word "experience" in an entertainment context makes me gag.
A few months ago I purchased a rollercoaster simulator.
Fired up and loaded one of thousands of coasters you can download off the net... it showed a rolling ...coaster with neat 3D graphics on my screen.. No shooting zombies or dodging alien death rays... just a car on a fixed track you have no control over. Boring ...as... f***. ... very same software /w Rift.
Holy f*** this is a lot of fun.
It's like 3D TV
Rift is the difference between watching something on a screen and being somewhere else. It's a hoot... so much so I don't waste my time with "flat games" anymore. Too painful... like going back to an Atari 2600 after having a NES.
3DTV is watching the same TV only with a stereo vision effect. An effect that drops off after a few meters IRL anyway and has never been a dominant means of judging scale and distance.. Nice but no big deal.
an expensive and largely useless toy that really only irrationally exuberant developers and people with more money than common sense will buy.
Look up Jewelers and new car dealerships in your local yellow pages.
These things now make calls just by anonymous voice commands? Really? This is a massively irresponsible design. Even telephone number hyperlinks on websites require manual confirmation prior to dialing. Now anyone can create a website that plays call x, y and z to get your victim into trouble, stalk victims and or rack up toll charges or do the same via TV/radio broadcast.
They know it's dumb. They just can't help themselves.
If you've loved the last two decades of comically insecure Flash players and PDF readers your going to love the future where anyone's systems can now be owned by closed source adobe CDM modules.
Yup. People act like a decreasing population is a disaster, but the reverse true. Put bluntly there are too many people on this planet
Sustainable carrying capacity of the planet is not static.
Single individuals in industrialized countries consume the resources of dozens of people in poor countries.
Production, management and availability of technology and resources dominate outcomes much more so than counts of living humans.
either reduce our population, as Japan is doing, or suffer the consequences (see India, Africa etc).
Or you can spend 30 seconds thumbing through lists of countries by actual population density and realize the premise of this argument does not hold up.
https://en.wikipedia.org/wiki/...
Japan is living proof that this can be done in comfortably, despite the dire warnings from economists and politicians with an investment in the perpetual growth con.
Japan "comfortably" has the worlds highest debt load by percentage of GDP.
Tell them you won't visit their sites anymore if they continue to facilitate Facebook's or Google's or anyone else's cross-site cyber stalking.
If your going to sue anyone consider directing your legal efforts at site owners for facilitating cyber stalking. Don't waste your time with Facebook.
Contribute to public awareness campaigns that equate Facebook logos on websites with eye of Sauron in the minds of users. The thing cyber stalking firms fear most is sunlight... an informed public knowing they are being stalked everywhere you go by nameless creepers enmasse.
If there is a price to be paid even a small one site may think twice before cut and pasting bug code especially where the same or very similar goals can be achieved without enabling Facebook stalking.
Telling someone your going to do something first before you do it does not legitimize the underlying action.
Amount of data required to be sent to Microsoft to ensure proper operation of Windows is 0 bytes.
Take it or leave it demands are not choices to the extent Windows is not a commodity and leaving it isn't a viable option.
Windows 10 is malware.
Let domain registrars handle it, so they can charge $99 a year for a secure certificate? That artificial barrier to entry and clear predation of consumers is precisely why Let's Encrypt was formed. A commercial CA doesn't give a fuck what happens to you as long as you paid for the cert.
My belief is one or both of the following must happen:
1. Domain registrars should be required to assign certs automatically as standard part of domain ownership or everyone should just drop the current system and switch to DANE. Registrars must not be allowed to treat it separately as an "add-on".
2. Domain registrars should be required to provide domain owners authorization tokens consumed by CAs and other entities to securely provide proof of ownership/control to existing DV CA's and or LE for verification purposes.
I would very much prefer to see the current system burn to the ground and replaced entirely with DANE. There is significant negative value in the existence of CAs performing automated DV.
If the attacker controls the domain, then the certificate is valid.
The problem is an attacker does not need to control the domain. They just need to control packets to and from it.
The CA is not verifying that you are not doing anything bad, just that you control the web server. The same is true for LetsEncrypt certificates.
If this were true there would be no problem. Unfortunately the assumption CA is verifying administrative control over a web server is provably false.
The entire point of having CAs issue public key is prevention of MITM attack from those with access to packets to and from a victims network.
HTTP traffic from any web server is trivially vulnerable to MITM attack. If I can access Internet traffic from my victims network I can go to any DV CA on the planet using completely automated means have a CA assign me a key I can then leverage with impunity to MITM my victim without detection from that point forward.
This isn't what I would call security nor is it necessary or defensible. It's simply terrible and idiotic.
So if some bad guy can register any domain, and put up a website, they can purchase a cert that is trusted by your browser.
For their own domains, not someone else's.
How can you TRUST that this website is not bad
Passing judgment as to the disposition of a site isn't the point of DV certs. The only thing DV certs are supposed to do is make sure those with administrative control over a domain are the same people who have administrative control over the issued cert. The problem is automated verification procedures currently widely deployed are wholly incapable of making such determinations.
Personally I would be more concerned with exfiltration than deletion but if MS wants to provide safety they should consider versioning file system so that designated folders can be rolled back to prior states no matter what happened to the data. Not all fail is intentional and this could provide useful value beyond attack resistance.
Aspect based access control mechanisms have a tendency of subverting themselves in the name of convenience over time. First there was the windows firewall, then every app installed makes exceptions for itself and before you know it firewall may as well no longer exist.
I'm not sure how they could even implement such a thing in a meaningful way. What prevents an attacker from overwriting the application and then proceeding to encrypt files or suffering large numbers of false positives as apps are updated resulting in error fatigue and rendering "notification" useless.
This could be done by running apps in isolated containers and assigning access rights to shared stores to the container rather than the software. This is what windows should be doing to meaningfully improve secure wherever it can possibly get away with it.
We could have had that.but DANE is worthless without DNSSEC and everyone is too lazy to implement DNSSEC.
DNSSEC should not be deployed until DNS amplification countermeasures are fully deployed. This can be RFC7873, TCP, (D)TLS... I don't care which... To go ahead with deployment of DNSSEC knowing DNS infrastructure will be leveraged to launch massive DDOS attacks is massively irresponsible.
For an attacker to initiate the process and successfully complete the validation, they would either need control of the server (or be able to impersonate it), or control of the authoritative DNS records.
The assumption here is that it would be difficult to MITM LE themselves when doing authoritative DNS lookups.
You don't have to MITM LE's infrastructure. All that is needed is to MITM your victim's wire which may well include DNS traffic toward their (authoritative) DNS server.
Sounds like your problem isn't with Lets Encrypt, it's with the entire concept of issuing encryption certificates, regardless of issuer.
My problem is with lets encrypt and every other CA automatically issuing certs using methods they know damn well to be completely insecure subject to the very same forms of attack certificates being issued are intended to prevent. It's a breathtakingly idiotic and dangerous practice.
I don't have a problem with the underlying technology. PKI is awesome when deployed properly. When deployed with the level of fail LE and other DV CA's are currently bringing to the table you damn well better believe I have a problem with it.
The sad part in all of this is that it's also pointless and trivially remedied. The domain registrars are the ones who should be handing out domain certs as they already have relationships with domain owners. At the very least registrars could be providing authorization tokens to be consumed by third party CAs. There is no excuse for current behavior and practices.
Not quite -- the client generated a private-public key pair when it first contacted LE, communications between the client and LE are encrypted, and the client answering the challenge is required to sign a nonce provided by LE using their private key. The MITM near the server side of the connection does not have the private key, and so cannot read what the challenge value should be, and cannot sign the nonce.
Are you referring to a legitimate domain owners client or an attackers client?
Trust whom, the site owner? LE? Their CA? If you don't trust root CA, then you are SOL. Better unplug your computer.
My remarks are limited to establishing domain ownership.
Ownership of what, the hostname? The client requesting the certificate has to satisfy a challenge, for example placing a file with specific contents at a specific location controlled by the hostname, or populating a specific DNS record with a specific value for that hostname's zone. If the client is able to satisfy those challenges, then it already has complete control over the hostname and the content it serves.
DNS is insecure.
HTTP is insecure.
The routing infrastructure of the Internet itself (BGP et al) is insecure.
Both DNS and HTTP are subject to trivial MITM attack by anyone with access to a victims wires.
If the answer is it depends on responses from any of these protocols then one might as well implement RFC3514 and roll out a mission accomplished banner.
How does it demonstrate that? Can you explain specifically what makes this better than self-signed certs? What is the basis of trust used to establish ownership? What prevents an attacker with access to a victims wires from using LE to obtain fraudulent certificates?
Public key cryptography. The client has to satisfy both the domain control challenge, and sign a nonce provided by the CA. The domain control challenge establishes control over the domain. The signed nonce provides client identity verification.
This isn't about the basics of PKI it's the basics of establishing TRUST that's the heart of my question regarding LE.
The basis of any secure system is TRUST not alphabet soups of cryptographic jargon. It's asking the basic question "WHY SHOULD I TRUST YOU?" and receiving a reasonable, verifiable response.
How does LE vet ownership to even assign certificates in the first place? What makes this process secure and trustworthy? If there is no good answer to that question all the cryptography in the world means nothing.
They're a little better in that the fact that they come from a cert authority gives you some assurance that you're not being MITM'd. But it has always been stupid that browsers treat an HTTPS connection with a self-signed cert differently to an HTTP connection.
All lets encrypt does is move the point of MITM vulnerability from establishing a connection to obtaining the cert. A functionally equivalent MITM opportunity to untrusted self-signed certs persist regardless.
The fact that end users see a padlock icon in their browser and *assume* their connections are secure when in fact there is no rational basis for such a belief is a far worse reality than doing nothing.
My own view is that ALL DV CA's including LE should be shuttered immediately. All responsibly transferred to domain registrars who already have relationships established with domain owners. Current system is nonsensical, redundant, dangerous and completely unnecessary.
Also, unlike self-signed certs it demonstrates that the person requesting the cert has control over the hostname(s), which is pretty much all I ever had to do when I paid for a non-EV certificate.
How does it demonstrate that? Can you explain specifically what makes this better than self-signed certs? What is the basis of trust used to establish ownership? What prevents an attacker with access to a victims wires from using LE to obtain fraudulent certificates?
Yeah, how can the disabled be so selfish as to demand equal opportunities!
Life isn't equal. People are not equal. There is no such thing as an equal opportunity that does not involve taking. Demanding others take a course of action to accommodate you at their own expense is inherently a selfish act.
There are limits to human generosity.. to how far people individually and by extension as a society are willing to go out of their way to accommodate others. Rampant abuse of ADA by lawyers is only making things worse for the disabled by pushing public sentiment in the wrong direction chipping away at legitimacy of ADA itself.
Voices of the disadvantaged seeking help are being drowned out by an emerging industry of assholes gaming the system with an objective function of self enrichment. The rate of increase of ADA lawsuits is both comical and unsustainable.
People who stand up for the disabled are DICKS! Yeah!
Many of them are in fact dicks suing people with the sole intention of helping themselves to other peoples money rather than helping other people. I'll leave the insane trend line of ADA suits speak for itself.
There is now such a sprawling population of dicks looking to cash out on ADA suits I now assume anyone filing ADA suit is a dick until evidence is presented to the contrary. It's much easier that way. The default assumption is way more often to be right than wrong.
Let's not bullshit or pretend that being "techie" makes it somehow better. Malware = terrorism. And yes, that swings both ways.
Behind every act of terrorism there is political demands to enforce rules backed by threat of violence from an external entity challenging a states monopoly on violence.
Malware is generally just another criminal commercial money making enterprise. Whether it's a group of poor Canadian crackers looking to enrich themselves or multi-national corporations (e.g. Microsoft) profiting off distribution of malware.. it may be illegal or immoral yet without the political demands it is not terrorism.
It seems insane that the Royal Navy & BAE systems couldn't figure this out themselves. This has the smell of a kickback based sales agreement to me. Almost any other operating system is a better choice simply because they are smaller attack targets than any version of Windows.
When your adversaries are other nations security by obscurity is especially inoperative.