Comment on Letsencrypt is under US jurisdiction. Is there a free-er alternative?
RabbitBBQ@lemmy.world 13 hours agoAny Govt agency with sufficient power can go to LetsEncrypt and have them either decrypt everything or issue specific certificates that can be decrypted and transparently allow man in the middle monitoring. That so much of the internet is using LetsEncrypt makes it highly likely this is all going on. It’s technically possible and the Govt wouldn’t allow LetsEncrypt to operate without being able to do this. Really this is true with all devices and encryption allowed to be sold. Unless you secretly meet all their demands they control all the required certifications and access to be able to sell your products, list them on the app stores, etc. It’s just a good rule of thumb to consider everything has this starting point unless you design and build the entire hardware and software stack to ensure nothing like this can be done. But you’ll never be able to sell it.
3abas@lemmy.world 11 hours ago
Fortunately, that’s not how it works.
The private key is created on your server, not by Let’s encrypt, and it’s never transferred to them. Nobody can decrypt your data.
Certbot (the official ACME client) is open source, but you’re also welcome to use any other client of your choosing, or make your own. The secrets never leave your server.
Unless the NSA has working powerful quantum computers that can break public key encryption, that they are successfully hiding from the public, they wouldn’t be able to break let’s encrypt certificates backed public key encryption, the math just doesn’t math. It would still take the most powerful super computers millions of years to break RSA 2048.
There’s a reason they want to make encryption illegal, instead of just letting us trust it like sheep. Thankfully, we don’t have to trust anyone, it’s all verifiable math.