Technology

60052 readers

2821 users here now

This is a most excellent place for technology news and articles.

Our Rules

Follow the lemmy.world rules.
Only tech related content.
Be excellent to each another!
Mod approved content bots can post up to 10 articles per day.
Threads asking for personal tech support may be deleted.
Politics threads may be removed.
No memes allowed as posts, OK to post as comments.
Only approved bots from the list below, to ask if your bot can be added please contact us.
Check for duplicates before posting, duplicates may be removed

Approved Bots

founded 2 years ago

MODERATORS

[email protected]

362

Let's Encrypt Announces New-Certificate-Every-6-Days Offering (letsencrypt.org)

submitted 6 days ago by [email protected] to c/[email protected]

108 comments fedilink hide all child comments

via https://it.slashdot.org/story/24/12/15/0059216/lets-encrypt-announces-new-certificate-every-6-days-offering

you are viewing a single comment's thread
view the rest of the comments

[–] [email protected] 1 points 4 days ago* (last edited 4 days ago)

I mean, if someone tries to “man in the middle”, or maskerade as my website, the trusted stuff will not add any security.

As long as they can obtain a certificate signed by a trusted signer for your name, you are correct. And you are touching on a real issue here. The number of trusted signers in the browser stores is large, and if only one can be tricked or compromised, then the MitM can generate a certificate your browser would trust just as well as your own original one.

If someone hacks my site [...]

then it's over anyway, yes. The signature on the certificate only validates your TLS key as being one that was properly assigned to the holder of your domain name. Once the endpoint is compromised, TLS doesn't matter anymore.

if the browsers weren’t locked down

Actually maybe they aren't as locked down as you think. To my knowledge you can add your own signing key certificates to your local installation of Firefox, Chrome and the Windows cert storage. In fact there are companies who do this a lot. They Man-in-the-Middle all their employees, with a proxy that does security scanning. For this reason they will deploy their signing keys internally. So the browsers still work. You can use these mechanisms for yourself if you like.

Example documentation: https://support.mozilla.org/en-US/kb/setting-certificate-authorities-firefox