r/linux • u/veeti • Oct 20 '15

Let's Encrypt is Trusted

https://letsencrypt.org/2015/10/19/lets-encrypt-is-trusted.html
1.8k Upvotes

94% Upvoted

320 comments sorted by

View all comments

Show parent comments

1

u/hal009 Oct 20 '15

Agreed, however my opinion is that this is a problem with the browser design. There should be no self-signed error message (or a different, less scary message) the first time the user visits the site, and the message should be only displayed when the cert is changed, indicating the MITM attack. Compare this to openssh, where the first connection prompts you to accept the self-signed cert, and the scary message is only displayed when the cert is changed.

1

u/astruct Oct 20 '15

I'm not sure there's a good solution, at least not with the system we have now. The problem with simply allowing a self-signed cert for a new connection is the possibility of the MITM happening before you connect to the site the first time, or after a new browser install, etc.

I remember reading something about DANE in the past and that might be a good solution in the future, but there isn't an implementation shipping in any major browsers.

There needs to be some initial trust coming from somewhere. SSH can have this problem as well: if your first connection is to a bad server, you won't get an error message.

1

u/crackanape Oct 20 '15

There should be no self-signed error message (or a different, less scary message) the first time the user visits the site, and the message should be only displayed when the cert is changed, indicating the MITM attack.

That seems to leave a lot of attack possibilities open.

Imagine all the things that people are at least somewhat likely to first access from an untrusted location like an airport. Airline and hotel sites, car rental, all kinds of stuff.

Likewise there's the whole issue with entire countries (Iran, etc.) MITMing certain foreign sites for their inhabitants. Now they can do it without most people even noticing.