Hacker News Reader

Comment by johnwheeler | Hacker News Reader

I remember reading through the forum post for that letsencrypt bruhahaha when Comodo filed for trademark infringement on Letsencrypt.

The CEO seemed really self absorbed and saw himself as an innovator with letsencrypt stealing business processes from him (which makes filing for trademark infringement make less sense). He took it as a personal insult, and did not even appear to understand that letsencrypt was a public service rather than a for-profit product.

There was a fan who claimed to be a paralegal cheering on the CEO's rant yet appeared to confuse trademarks with patents with copyrights.

At least with the forums alone, that thread read like teenage high school soap opera, not a business. It was like an echo chamber of the CEO's fixation.

And now this. Sounds like there was a deliberate business decision to use faulty tech, and forgetting the wider social impact of operating a CA.

Here's the forum post in question

https://forums.comodo.com/general-discussion-off-topic-anyth...

Here's the HN discussion

https://news.ycombinator.com/item?id=11964583

I recently replaced an expired cert with one from LE and the entire process was super simple. Their cli automatically handles all the tedious steps like creating the signed request, proving server ownership, and creating the certificate bundle. What's more, it also provides tools for renewing certs in an automated way. I really can't see myself using anything else from here on out.

Last time I checked the LE cli tool required root access to my machine. Totally annoying and unnecessary.

Otherwise, I applaud the initiative.

There are alternative clients one can use like acme_tiny.

How does this meme keep getting repeated over and over and over when it was wrong the day LE launched? It doesn't even make sense if you just think about it. Why would you need root access to make some HTTP calls? Most ACME clients don't require root. The one-click-and-reconfigure-my-webserver obviously requires root.

Certbot defaults to a path on your system that requires root, and sets permissions so non-root users can't look at your private keys.

If you would like to use it without root/sudo, you can pass flags changing the directory it uses. For example:

    certbot --logs-dir ~/SSL --work-dir ~/SSL --config-dir ~/SSL

Just saying, the following domain is available:

    1etsencrypt.org

I took too long to notice what was wrong, despite the subject of this post. Maybe punycode for ascii?

You might need to upgrade your OCR package ;)

This really comes down to the weakest link though. You can use letsencrypt if you want, but someone else can still spoof your domain with a fake Comodo cert and any of your users' browsers will happily trust it.

Public key pinning seems like it would prevent this attack though.

To clarify, Let's Encrypt validates identity by trusting DNS resolution of a domain and then trusting a TCP/IP connection to the IP, correct?

It's good to encrypt things, but I wouldn't be too surprised if it were possible for folks to issue bad certs via them, as well.

Yes, this is called domain validation and most CAs operate like this for regular non-EV certificates. Sometimes it's an email, sometimes it's a file with certain content at a certain URL, sometimes it's a DNS record. But beyond that, no further validation is required for regular certificates.

I don't know why you were down voted. Yes, Let's Encrypt does verification by requiring a site to host a string on port 80. They discover the site via DNS, and they do NOT require DNSSEC. Thus you can absolutely trick Let's Encrypt into issuing a bad cert if you can serve them bad DNS responses.

This OCR issue with Comodo in TFA concerns WHOIS data, which may or may not be more reliable than unsigned DNS data. Regardless your point remains valid.

You can also trick practically every other CA using the same techniques.

Yes. And remember you only have to trick one of them for them all to be useless :)

Reply on news.ycombinator.com