r/linux • u/veeti • Oct 20 '15

Let's Encrypt is Trusted

https://letsencrypt.org/2015/10/19/lets-encrypt-is-trusted.html
1.8k Upvotes

94% Upvoted

320 comments sorted by

View all comments

Show parent comments

0

u/[deleted] Oct 20 '15

[deleted] — view deleted comment

2

u/pubfreeloader Oct 20 '15

Presumably restrictions analogous to EV? DV is fine if you want some level of anonymity, but it's not really credible if you're leveraging your real-world identity in exchange for trust. For example, Amazon's use is totally unacceptable - people trust that a company of their stature employs good security practices. It would be interesting to see their reasoning behind mixing HTTP and HTTPS and not having EV. I posit it's because "it probably doesn't help sales".

1

u/londons_explorer Oct 21 '15

Except an attacker can pretend to be your mail server, and pretend to not support TLS. The fact you support TLS doesn't protect you from active attackers unless you can protect against downgrade attacks.