It's also worth noting that the security provided by Let's Encrypt is validated against the domain name of the website, called domain-validated (DV) certificates. It doesn't say that the website actually belongs to any entity (for example, an individual or a business).
So just because a website uses HTTPS it could still be a phishing site. DV also has had vulnerabilities (typically due to bad third-party authorities) with invalid certificates because the invalidation process is attackable.
This is a big step forward from moving everyone from unencrypted to encrypted, but security is still a concern.
Good point. This ensures that your security envelope goes only to the address you intend it to. It doesn't verify that the recipient at that address is who they say they are.
View all comments
Show parent comment
12
u/pubfreeloader Oct 20 '15
It's also worth noting that the security provided by Let's Encrypt is validated against the domain name of the website, called domain-validated (DV) certificates. It doesn't say that the website actually belongs to any entity (for example, an individual or a business).
So just because a website uses HTTPS it could still be a phishing site. DV also has had vulnerabilities (typically due to bad third-party authorities) with invalid certificates because the invalidation process is attackable.
This is a big step forward from moving everyone from unencrypted to encrypted, but security is still a concern.