I know that I can simply make my own private certificate authority that only I and my family trust. But is there some public provider like letsencrypt that is in a free-er part of the world than the US?
It is surprisingly easy to add a custom CA to phones and laptops. When I migrated to services using one with names like
thisservice.lanI thought it would be a lot harder. I just have a generation script that makes a new cert and I throw it in NGINX.Is anyone wonders why it’s a problem it’s under US juristriction:
Look up the US Cloud Act. It’s everything the media told you China was, but in the hands of an orange dictator.
They have strong canaries in place, namely certificate transparency. They wisely designed themselves in a way to prevent themselves from tampering.
Well, honestly?
Since these certificates are not banned nor up for debate, the NSA probably already have a way to get all the data through another loop hole.
Yes, it protects against “attacks” from outside, but it’s naive to expect they dont have another way in which goes beyond LetsEncrypt.
That loophole is Google and probably cloudflare. Google has their own DNS service, a script tag on nearly every website, half the mobile phone market while being the default search engine on the other half, and provides email to the majority of people. Even if you try not to use their services, they still have an enormous amount of information about you.
Any Govt agency with sufficient power can go to LetsEncrypt and have them either decrypt everything or issue specific certificates that can be decrypted and transparently allow man in the middle monitoring. That so much of the internet is using LetsEncrypt makes it highly likely this is all going on. It’s technically possible and the Govt wouldn’t allow LetsEncrypt to operate without being able to do this. Really this is true with all devices and encryption allowed to be sold. Unless you secretly meet all their demands they control all the required certifications and access to be able to sell your products, list them on the app stores, etc. It’s just a good rule of thumb to consider everything has this starting point unless you design and build the entire hardware and software stack to ensure nothing like this can be done. But you’ll never be able to sell it.
Fortunately, that’s not how it works.
The private key is created on your server, not by Let’s encrypt, and it’s never transferred to them. Nobody can decrypt your data.
Certbot (the official ACME client) is open source, but you’re also welcome to use any other client of your choosing, or make your own. The secrets never leave your server.
Unless the NSA has working powerful quantum computers that can break public key encryption, that they are successfully hiding from the public, they wouldn’t be able to break let’s encrypt certificates backed public key encryption, the math just doesn’t math. It would still take the most powerful super computers millions of years to break RSA 2048.
There’s a reason they want to make encryption illegal, instead of just letting us trust it like sheep. Thankfully, we don’t have to trust anyone, it’s all verifiable math.
'Muricans are so racist, we heard “orange chicken” and thought they were talking about China. 🤣
I do think we’ll end up scrambling for alternatives at some point, so better to do it now.
every single accusation is an admission
Simi-related fun fact.
The biggest contributor to TOR is the CIA. They funded it’s creation and are primarily responsible for maintaining it to this day.
The CIA maintains TOR as a way for spies to pass information over the internet. They make it public because if only spies used TOR it would be trivial to catch them. So it’s in their interest that it be public and secure. It’s open source and security experts agree you can trust it.
So since this, according yo you, is a fact, I do suppose you have evidence to this claim? And I’m talking evidence that can be corroborated, not a Facebook post or something from a conspiracy sub, and not “oh man, everybody knows this!” because everybody doesn’t know this.
Crazy that you’re downvoted for asking for sources lol
There’s a thing called search engines, it takes about 20 seconds, much less than waiting for a reply you asked for in a mocking tone. What about “security analysis tor protocol”?
I thougnt it was the Navy, not CIA itself
Yeah it was the NRL in Annapolis, Maryland
There are some commercial Certificate Authorities that offer free certificates. But in contrast Let’s Encrypt is a non-profit.
- ZeroSSL (Austria)
- Actalis (Italy)
Also the controlling party in Italy is practically neo-fascist and Austria is also sliding there again with their Nazi party like AfD in Germany and VB in Belgium getting a huge portion of votes.
I don’t see how it is that much better than a US non- profit.
I think the core thing is that you have to know of a bunch of different CA options and switch when necessary or on a compromised CA.
The thing is, the US is already fascist. Austria (current day) would be an improvement.
Also, you know the downfall of Autistici/Inventati - No - check my post history. One of the events that happened is that US owned PIR removed one of the domain names since they own .org. One less US entity, one less point of failure.
commercial
free certificates
How do they make money?
What risk are you trying to mitigate, specifically?
If it’s the CA taking over your site, control over your CA specifically doesn’t really give any advantage to an attacker (they would have to hijack traffic and provide a new certificate - nobody will notice if the certificate is from a different CA).
Note that your CA cannot decrypt the exchanges between your server and its clients.
It opens the possibility of a man-in-the-middle attack.
which is still there if you are not using lets encrypt, because they can strongarm them to make a fake cert for your domain, and install a proxy repackaging HTTPS traffic with the fake certificate. all browsers trust the lets encrypt root certificate, so they won’t see anything suspicious.
the only thing there today to detect this (but not avoid) is certificate transparency logs. all modern certificates are required to be added to this log, for the CA to remain compliant. but browsers are not checking the logs, that would be a lot of additional traffic and how do they decide if a certificate was created maliciously? also, lets encrypt could afford being noncompliant, browser vendors can’t realistically just distrust their root certificate, many sites would become inaccessible.
Oh snap! That definitely sounds possible. Found more info about it.
tl;dr: Either the attack is ineffective against some browsers that check the certificate transparency logs (like Chrome), or the attack is visible and the CA will lose all its credibility (hopefully being removed from the browsers).
and details: https://wiki.mozilla.org/SecurityEngineering/Certificate_Transparency
this sounds important:
This information has a 10 week expiration time. That is, if 10 weeks have passed since the information has been updated (typically by updating Firefox itself), the implementation will no longer enforce certificate transparency.
this also means, it can’t truly verify SCT’s that were issued since the last browser update?
it seems Firefox started doing the CT validation too, without needing to contact the CT log service: https://developer.mozilla.org/en-US/docs/Web/Security/Defenses/Certificate_Transparency#browser_requirements
Yep, that’s what I described and any CA accepted by the client can do it
I don’t think anyone is gonna solve that problem until it’s actually a problem.
I don’t think anyone’s going to solve the problem in general, to be honest.
Like, Let’s Encrypts goal is super novel, but also expensive as shit to actually run, and requires a lot of coordination because it needs to be a trust authority. If this ever happened, it would probably be at the backing of some government structure, because I don’t see many people wanting to jump at that as an expense.
You need to restructure your priorities.
Or use a ca, vps and dns provider that’s hostile to the west.
It’s not a question of supporting “freedom” and if you insist that it is, I will gladly provide all those services to you for a slight markup (price of freedom!).
First let’s identify what parts of the world are free-er than the US (for a certificate).
Malta or Cyprus maybe? My first thought is places where dodgy people do dodgy shit, like gambling.
Why not use veracrypt instead?
