Hacker News Reader

Comment by qwerty456127 | Hacker News Reader

Obviously, HTTPS adds complexity many people find unnecessary + it puts you in position of depending on a 3-rd party - a certification authority.

In fact you can program almost any device (including very old and simple) to be a plain old HTTP client or a server but this is not the case with modern HTTPS.

View on HN

Thanks to Let's Encrypt, this is no longer the case.

Let's Encrypt is a 3rd-party.

I was responding to the second paragraph. TLS is not complicated now.

Being easy to use does not mean uncomplicated. Your TV set probably is easy to use and was easy to get but it still is an extremely complex machine. Using as simple things as possible (but not simpler ©) is a value in its own.

Then you have a signed key but you still have to implement the crypto algorithms.

Which is as easy as running one of a half dozen open source TLS proxies in front of your regular, unencrypted HTTP application port.

You don't need to "implement the crypto algorithms" unless you're reinventing the wheel. You just need to get the private key and certificate (run certbot) and configure your server software (change your settings).

Alternatively, use caddy as a HTTPS server. It requests the certs from letsencrypt for you, for all domains that you configure it for.

You don’t know what state actor is running it though.

LetsEncrypt is good enough to protect you from ISP malfeasance and script kiddies on your public wifi.

But if your threat model includes nation states then LetsEncrypt should only be one part of your defense in depth strategy.

It literally does not matter for you if Let’s Encrypt is run by a hostile entity. They never get your private key, they only give you a certificate saying your key is valid.

Would anything nefarious be made possible by them granting someone _else_ such a certificate?

Sure, but LE could always do that, even if you don’t use them. So that is still not a reason to avoid using them.

Reply on news.ycombinator.com