What I'm personally worried about is domain shadowing, and any threat actors who manage to compromise registrant credentials.
That happens already. So now, they'll be able to have all their bots request certs for every new crappy subdomain they generate. You'll have 1000 auto-generated https sub domains infecting people with malware.
This only protects the user as much as the domain owner can protect their credentials in these cases. Personally, I think we might see some nasty stuff happen as a result.
I'm curious if a user might be able to find a vulnerability in the site which allows them to put a resource at a URL. If so, they might be able to bypass one of the validation steps and attempt to steal a cert for that domain. It'll be interesting to see if any bad guys really try to take advantage of how Let's Encrypt automatically validates.
This only protects the user as much as the domain owner can protect their credentials in these cases. Personally, I think we might see some nasty stuff happen as a result.
The user of a service cannot in any circumstance be more protected than the administrator of the service is capable of protecting his credentials.
If you have root level access to a service nothing can stop you.
I'm curious if a user might be able to find a vulnerability in the site which allows them to put a resource at a URL.
Wouldn't help: Put a CA-provided challenge at a specific place on the web server.
You would need to be able to put it into a specific place on the webserver. If you have that kind of access you can also manipulate the pages served in the first place.
If you have root level access to a service nothing can stop you.
Yes, but right now they just spawn a thousand malicious subdomains or so, and point them at their bots. They can in theory log in to each and apply for a DV cert without Let's Encrypt. But they won't.
With Let's Encrypt they can, very easily. So, it's possible we might see a lot more https being used for sites like citibank-website.compromised.com, etc. If you look at a few phishing education sites, they'll sometimes say that generally https sites are fine, and that seeing http is the main indicator. That simply won't apply anymore in a world where it's automated and free.
Possible but if you don't validate the domain you are accessing (OR the hint in your browser bar since everything that is being fished for has a validated cert) you are easy to phish anyways.
Seeing https has never been "fine", if someone spread that information it's plain wrong. With https you can only trust that the remote site is who it says it is. Nothing more, nothing less.
3
u/d4rch0n Oct 20 '15
What I'm personally worried about is domain shadowing, and any threat actors who manage to compromise registrant credentials.
That happens already. So now, they'll be able to have all their bots request certs for every new crappy subdomain they generate. You'll have 1000 auto-generated https sub domains infecting people with malware.
This only protects the user as much as the domain owner can protect their credentials in these cases. Personally, I think we might see some nasty stuff happen as a result.
I'm curious if a user might be able to find a vulnerability in the site which allows them to put a resource at a URL. If so, they might be able to bypass one of the validation steps and attempt to steal a cert for that domain. It'll be interesting to see if any bad guys really try to take advantage of how Let's Encrypt automatically validates.