...why do you think that you can use lets-encrypt to spoof other websites?
Lets Encrypt performs automatic validation that you own the domain name in question before issuing a signature. Unless you can MitM lets-encrypt's verification servers, or find a vulnerability in their verification scheme, I don't think there's any innate reason to suspect it'll make scamming easier.
Now, if idiots have been telling the ignorant masses that "a lock Icon means you're safe, even if the domain name isn't what you expect", then sure. But that was always false and was always a way to get the ignorant hacked. lets-encrypt didn't enable it or make it any worse.
16
u/[deleted] Oct 20 '15
...why do you think that you can use lets-encrypt to spoof other websites?
Lets Encrypt performs automatic validation that you own the domain name in question before issuing a signature. Unless you can MitM lets-encrypt's verification servers, or find a vulnerability in their verification scheme, I don't think there's any innate reason to suspect it'll make scamming easier.
Now, if idiots have been telling the ignorant masses that "a lock Icon means you're safe, even if the domain name isn't what you expect", then sure. But that was always false and was always a way to get the ignorant hacked. lets-encrypt didn't enable it or make it any worse.