<story><title>Let&apos;s Encrypt is Trusted</title><url>https://letsencrypt.org/2015/10/19/lets-encrypt-is-trusted.html</url></story><parent_chain><item><author>lorddoig</author><text>Being told that you now trust someone with your secrets via a news website is a pleasingly succinct display of everything that&amp;#x27;s wrong with the CA model.</text></item></parent_chain><comment><author>geofft</author><text>Well. The CA model is &lt;i&gt;community&lt;/i&gt; trust. I am told all the time, often by news websites, that my government now trusts or distrusts some other government, that my employer now trusts or distrusts or is even part of some other company, etc. I don&amp;#x27;t know if I personally think that the embargoes on Cuba should be lifted, or my company&amp;#x27;s new vice president is qualified for the role, or (if I worked for VMware) Dell is a good employer, or my savings should now be held by Bank of America, or whatever. But that&amp;#x27;s how living and working in a community works.&lt;p&gt;If you have secrets that are too sensitive for community trust, there are other mechanisms, but they typically have trouble scaling very much beyond continuing a previous face-to-face relationship. For the question of whether, say, news.ycombinator.com is who they say they are, I don&amp;#x27;t care enough to take Caltrain down to YC&amp;#x27;s offices and check a fingerprint posted on the wall, if they had one. What I care is that, &lt;i&gt;at scale&lt;/i&gt;, the certificate authorities I trust will do a good job of verifying identities and running secure systems.&lt;p&gt;And &lt;i&gt;I&lt;/i&gt; am not an auditor or pen-tester of large companies, and even if I were, I wouldn&amp;#x27;t want to spend my spare time auditing and pen-testing all CAs just before I can use the internet. (Importantly, I am not an auditor of web browsers or SSL implementations either, and since I outsource my trust to my browser &amp;#x2F; SSL stack, it&amp;#x27;s not useful for me to be skeptical of the CAs unless I&amp;#x27;m also skeptical of the code.)&lt;p&gt;Remember that the CA model is bare-minimum security. (Some of the CAs find money in telling you otherwise, but they&amp;#x27;re stretching the truth.) All it&amp;#x27;s providing is the security that, in a perfect world, you would have gotten all along from DNS and IP. If you need anything more than bare-minimum security, there are tons of options, ranging from the SSL-based (EV, HPKP) to the completely unrelated (PGP, Pond, etc.). But the world needs a good mechanism for the simplest security that could possibly work, and the CA system seems to have settled into that role.</text></comment>
<story><title>Let&apos;s Encrypt is Trusted</title><url>https://letsencrypt.org/2015/10/19/lets-encrypt-is-trusted.html</url></story><parent_chain><item><author>lorddoig</author><text>Being told that you now trust someone with your secrets via a news website is a pleasingly succinct display of everything that&amp;#x27;s wrong with the CA model.</text></item></parent_chain><comment><author>vonklaus</author><text>&lt;i&gt;We’re pleased to announce that we’ve received cross-signatures from IdenTrust&lt;/i&gt;&lt;p&gt;This is what is wrong with the CA, model, not their method of announcing it to a community anxiously awaiting the arrival of their product. What is absurd is that identrust has a shitty non-responsive 90&amp;#x27;s looking website and wants $299 for an SSL certificate, which is something that should be free. I will say though, they really did sell me on their trust worthiness with the alternating images of a fingerprint and a lock. So now I know they&amp;#x27;re legit. It is worth the $99 for SSL on a single site annually because there is binary data superimposed on some of the pictures.</text></comment>