Comment by rvnx | Hacker News Reader

Comment by rvnx | Hacker News Reader

Parent Full thread

They will not stop Letsencrypt abroad, it is clearly an asset for the US gov, the same way that Cloudflare is a worldwide MITM, it would be absurd to shut it down.

If you are a letsencrypt user, then it is nearly impossible to see (even with CT logs) that there was a malicious interception. From a website operator it looks like a pretty standard renewal as Letsencrypt has a short validity duration anyway.

Add on top of that in the US they have access to easy and non-BGP entry points to reroute traffic (Google DNS, Cloudflare DNS).

They can intercept in practice all Cloudflare and all Letsencrypt sites (except the Letsencrypt they also need cooperation of a friendly DNS and have a very theoretical little risk to get caught in CT logs).

Big sites like Meta or Google or Amazon already have to cooperate and intercept internally so in practice almost all western internet is interceptable rather easily.

There is zero world where US gov would want to stop that.

The tech guys working for the NSA are from being idiots, and it would be insulting to even consider that. They would fight to protect Letsencrypt

Good thing they never do any absurd things nowadays.

Sure you can, you know what your public key _should_ look like

Excatly. There must be tools to automate checking newly issued certificates against your own copy, could anyone recommend a self-hosted one?

E.g.,

* https://github.com/SSLMate/certspotter

* https://certificate.transparency.dev/monitors/

Very unlikely in the real world.

Maybe <5% of devops are checking in reality (and this is very generous); even if they watch it is very difficult to spot since the CA is the same, and short-lived certificates (so very normal that they renew).

crt.sh is even answering 502 Bad Gateway, though it's supposed to be the most used tool to check CT logs in the world.

So maybe, true for few paranoid geeks who usually don't have any information of interest anyway, but not for the 99% others.

The big websites are openly sharing data to govs, so they are backdoored by definition, and they don't need to justify anything.

If you are checking the cert logs, it is a very tiny bit to validate the key as well. If you aren't checking... well, that isn't a concern anyway, now is it?

And the whole _point_ of the cert transparency log is that it only take _one_ such instance to ruin the credibility of a CA.

The fact that you do that in the public, and that it is _forever_, make it very hard to do in the shadows.

FWIW, I once got a cease and desist letter because "company-xyz" found that we were using a subdomain "company-xyz.customers.our-service.com".

They discovered that because they were monitoring the CT logs. And they were concerned about trademark issues. It ended up being one of the teams in "company-xyz" that had opened an account (under the company name, of course).

But that is just a small note that people _are_ monitoring those.

> They will not stop Letsencrypt abroad, it is clearly an asset for the US gov, the same way that Cloudflare is a worldwide MITM, it would be absurd to shut it down.

That’s does not mean they wouldn’t shut it down.

Reply on news.ycombinator.com