Creating a new topic to move technical discussion out of the death of privacy thread.

GooberMcNutly wrote:

Baywolfe wrote:

Anybody that knows Java, and the security classes can write a program to generate their own self-signed certificate.

Of course. But the secret with this one is that they got the browsers to accept their root authority, so by design they then trust all of the ones the root authority signs.

The system was originally broken. In order to set up an https site you need a certificate that is sourced from a root. The original idea was to prevent some "secure" site from pretending to be fazebook.com, taking your login and pw, then kicking you out to the real site, harvesting your info. But only if you required https, like everyone should be doing all the time. But to issue you the certificate you had to submit business paperwork and pay a huge fee, when all they do is generate the certificate with their magic key.

But now I guess we aren't as worried about impersonation of banks or whatnot. You just need a plain certificate, accepted by all browsers, that allows you and the web server to sign communications to each other.

But it begs the question. If you can get an easily acceptable key for nothing with no background check, what's the use of a signed certificate chain? Why not just have the browser not care about the root certificate in the chain? (They all currently show a scary message and make you click a couple of times to get around it.) It would be easier to program and it effectively allows the same thing. An easy config change in Chrome or Firefox would create the same "security" to the communication.

To get a Let's Encrypt certificate you still have to prove you control the domain.  This is the same process you'd undergo for a cheap certificate from any other certificate authority.  It offers basic assurance against an impersonation attack, which a self-signed certificate does not.  (Unless, of course, you have some other way to verify its validity.)

Banks and such are (hopefully) using Extended Validation certificates which require a more extensive verification process.  These cause the address bar in most browsers to turn green.

Whether the average user knows or notices the difference between these is questionable, but anyone reading this can certainly look for it when deciding whether to type in their banking password.

Auto-edited on 2020-08-02 to update URLs

Last edited by square (2016-11-15 01:09:32)