I know that I can simply make my own private certificate authority that only I and my family trust. But is there some public provider like letsencrypt that is in a free-er part of the world than the US?
I know that I can simply make my own private certificate authority that only I and my family trust. But is there some public provider like letsencrypt that is in a free-er part of the world than the US?
They have strong canaries in place, namely certificate transparency. They wisely designed themselves in a way to prevent themselves from tampering.
Well, honestly?
Since these certificates are not banned nor up for debate, the NSA probably already have a way to get all the data through another loop hole.
Yes, it protects against “attacks” from outside, but it’s naive to expect they dont have another way in which goes beyond LetsEncrypt.
That loophole is Google and probably cloudflare. Google has their own DNS service, a script tag on nearly every website, half the mobile phone market while being the default search engine on the other half, and provides email to the majority of people. Even if you try not to use their services, they still have an enormous amount of information about you.
Any Govt agency with sufficient power can go to LetsEncrypt and have them either decrypt everything or issue specific certificates that can be decrypted and transparently allow man in the middle monitoring. That so much of the internet is using LetsEncrypt makes it highly likely this is all going on. It’s technically possible and the Govt wouldn’t allow LetsEncrypt to operate without being able to do this. Really this is true with all devices and encryption allowed to be sold. Unless you secretly meet all their demands they control all the required certifications and access to be able to sell your products, list them on the app stores, etc. It’s just a good rule of thumb to consider everything has this starting point unless you design and build the entire hardware and software stack to ensure nothing like this can be done. But you’ll never be able to sell it.
Fortunately, that’s not how it works.
The private key is created on your server, not by Let’s encrypt, and it’s never transferred to them. Nobody can decrypt your data.
Certbot (the official ACME client) is open source, but you’re also welcome to use any other client of your choosing, or make your own. The secrets never leave your server.
Unless the NSA has working powerful quantum computers that can break public key encryption, that they are successfully hiding from the public, they wouldn’t be able to break let’s encrypt certificates backed public key encryption, the math just doesn’t math. It would still take the most powerful super computers millions of years to break RSA 2048.
There’s a reason they want to make encryption illegal, instead of just letting us trust it like sheep. Thankfully, we don’t have to trust anyone, it’s all verifiable math.