HTTPS Encryption via letsencrypt

[ASCII]

[...] "green bar" trusted SSL [...]

While those add a layer of trust through owner verification (but there isn't a single CA that hasn't fucked up multiple times in major ways when it comes to that), there's otherwise not much left in terms of upsides for premium certs.
From a purely cryptographic point of view, free and premium are fundamentally the same.
And since Let's Encrypt finally added wildcard certs, it's hard to point to any specific lack of functionality.
One reason I could think up to massively overpay like that, is when there's a very good reason to have extremely long lived certs, which is solved by setting up automatic renewal in a robust way.

Sorry for rambling, if someone want's to have a endlessly drawn out discussion about why I think BIG CA is an industry comprised of nothing but money grubbing conmen feel free to pm me lol.

But none of this matters all that much until someone hops unto the server and does the thing.

[Aidy]

Number of people conducting man-in-the-middle attacks to steal your password for Exclusively Games: 0
Number of people conned by the tens of thousands of phishing sites given legitimacy by letsencrypt certs every year as they'll cert anything: ???

[Ryan]

I'm not understanding the issue with Let's Encrypt. I utilize them for my business. Rather than paying $300/yr from GoDaddy's vampire tactics, I pay $0 for all the certificates I need from my hosting with SiteGround and they are issued by Let's Encrypt and certified by Avast. It's never been a problem for me or my clients.

[baboon]

While those add a layer of trust through owner verification (but there isn't a single CA that hasn't fucked up multiple times in major ways when it comes to that), there's otherwise not much left in terms of upsides for premium certs.
From a purely cryptographic point of view, free and premium are fundamentally the same.
And since Let's Encrypt finally added wildcard certs, it's hard to point to any specific lack of functionality.
One reason I could think up to massively overpay like that, is when there's a very good reason to have extremely long lived certs, which is solved by setting up automatic renewal in a robust way.

Sorry for rambling, if someone want's to have a endlessly drawn out discussion about why I think BIG CA is an industry comprised of nothing but money grubbing conmen feel free to pm me lol.

But none of this matters all that much until someone hops unto the server and does the thing.

I totally agree with everything you said, it's nonsense and we managed to survive pretty well for the last couple of decades without SSL being standard for the majority of non-transactional websites. I also agree that the green bar makes no difference to anything except the perception of websites and that is being foisted onto the general public. But it's apparently being pushed and Google Search and Chrome (most used browser now) will make a big deal about it.

People get used to it and then everyone has to use it or it doesn't look right, hence this thread exists I guess.

As I said, most hosting companies give it away free/part of the package. For a dedicated server with no provided management/support, a full fat Commodo one is what I would tend to use. I have never installed one myself, that's what my server guy is for, but in either case, I think it's probably best to have one because that is what people are coming to expect nowadays.

[ad_victoriam]

Number of people conducting man-in-the-middle attacks to steal your password for Exclusively Games: 0
Number of people conned by the tens of thousands of phishing sites given legitimacy by letsencrypt certs every year as they'll cert anything: ???

On the latter, fair enough. I think the OP suggested that source as an example rather than an endorsement.

On the former, it's just 0 so far. And overall his post here is more about tightening security and privacy globally with the website, which is a good idea.

[ASCII]

Number of people conducting man-in-the-middle attacks to steal your password for Exclusively Games: 0
Number of people conned by the tens of thousands of phishing sites given legitimacy by letsencrypt certs every year as they'll cert anything: ???

Right, because people mistake the purpose behind ssl encryption/certs to be some kind of guarantee of non-maliciousness. Which is patently false.
That's not the fault of Let's Encrypt. Hell, anyone can get those "official premium" certs, they just cost money (in some cases not even that). They are just as meaningless in that regard, maybe even worse because they appear somehow more trustworthy when they're really not. I can buy them in bulk under a false persona and nobody would stop me. Even takeovers are not unheard of because vendors are unbelievably lax when it comes to making sure you are who you say you are.

The importance lies in transport security and integrity, nothing more.

These false believes don't exist by accident though, CAs push this left and right because it's efficient marketing.

[Aidy]

That's not the fault of Let's Encrypt.

It's not, but they're still a big part in the problem. The whole "look for the padlock" idea came about when an SSL was much harder to not only get, but also implement, and it really did mean you could "trust" the site. Now you get different levels of cert where the verification guarantee is no longer assured, the only assurance you get is the encryption. However the whole "look for the padlock" thing is still stuck in a lot of people's heads. That's a big part of the problem...the problem is then allowed to manifest as people like letsencrypt will give you a cert even if it is obviously for a phishing site. They literally gave over 10,000 certs to sites with paypal in their name in one year alone. Letsencrypt's biggest failing is that they're not doing enough to protect people from phishing and other fraudulent sites. Then you have the ever-changing way different browsers reflect the different levels of SSL, and what started out as a good idea has descended into a fraudster's paradise.

Like everything else on the internet.....

[Revolutionary15]

I am also worried about the security of this website. While there might not be anyone looking at this forum with malicious intent yet, there is still a standard of care that must be met with any amount of user data. Hopefully this issue will be addressed very soon as it is a serious concern when running a website looking to be the hub of discourse for an entire community.

Thank you OP for starting this discussion.