Comment on Letsencrypt is under US jurisdiction. Is there a free-er alternative?
philipp_@discuss.tchncs.de 3 weeks agoThey have strong canaries in place, namely certificate transparency. They wisely designed themselves in a way to prevent themselves from tampering.
themurphy@lemmy.ml 3 weeks ago
Well, honestly?
Since these certificates are not banned nor up for debate, they probably already have a way to get all the data through another loop hole.
Yes, it protects against “attacks” from outside, but it’s naive to expect they dont have another way in.
418_im_a_teapot@lemmy.world 3 weeks ago
That loophole is Google and probably cloudflare. Google has their own DNS service, a script tag on nearly every website, half the mobile phone market while being the default search engine on the other half, and provides email to the majority of people. Even if you try not to use their services, they still have an enormous amount of information about you.
RabbitBBQ@lemmy.world 3 weeks ago
Any Govt agency with sufficient power can go to LetsEncrypt and have them either decrypt everything or issue specific certificates that can be decrypted and transparently allow man in the middle monitoring. That so much of the internet is using LetsEncrypt makes it highly likely this is all going on. It’s technically possible and the Govt wouldn’t allow LetsEncrypt to operate without being able to do this. Really this is true with all devices and encryption allowed to be sold. Unless you secretly meet all their demands they control all the required certifications and access to be able to sell your products, list them on the app stores, etc. It’s just a good rule of thumb to consider everything has this starting point unless you design and build the entire hardware and software stack to ensure nothing like this can be done. But you’ll never be able to sell it.
3abas@lemmy.world 3 weeks ago
Fortunately, that’s not how it works.
The private key is created on your server, not by Let’s encrypt, and it’s never transferred to them. Nobody can decrypt your data.
Certbot (the official ACME client) is open source, but you’re also welcome to use any other client of your choosing, or make your own. The secrets never leave your server.
Unless the NSA has working powerful quantum computers that can break public key encryption, that they are successfully hiding from the public, they wouldn’t be able to break let’s encrypt certificates backed public key encryption, the math just doesn’t math. It would still take the most powerful super computers millions of years to break RSA 2048.
There’s a reason they want to make encryption illegal, instead of just letting us trust it like sheep. Thankfully, we don’t have to trust anyone, it’s all verifiable math.
RabbitBBQ@lemmy.world 5 days ago
You’re not understanding Certificate Authorities or what certificate pinning does to stop man in the middle impersonation of firewall traffic. You have no understanding of what the Government is able to do to your devices and internet connection. You don’t have to take my word for it, I don’t care what you think. You just haven’t been a target to understand.