I know that I can simply make my own private certificate authority that only I and my family trust. But is there some public provider like letsencrypt that is in a free-er part of the world than the US?
Is anyone wonders why it’s a problem it’s under US juristriction:
Look up the US Cloud Act. It’s everything the media told you China was, but in the hands of an orange dictator.
They have strong canaries in place, namely certificate transparency. They wisely designed themselves in a way to prevent themselves from tampering.
Well, honestly?
Since these certificates are not banned nor up for debate, the NSA probably already have a way to get all the data through another loop hole.
Yes, it protects against “attacks” from outside, but it’s naive to expect they dont have another way in which goes beyond LetsEncrypt.
Any Govt agency with sufficient power can go to LetsEncrypt and have them either decrypt everything or issue specific certificates that can be decrypted and transparently allow man in the middle monitoring. That so much of the internet is using LetsEncrypt makes it highly likely this is all going on. It’s technically possible and the Govt wouldn’t allow LetsEncrypt to operate without being able to do this. Really this is true with all devices and encryption allowed to be sold. Unless you secretly meet all their demands they control all the required certifications and access to be able to sell your products, list them on the app stores, etc. It’s just a good rule of thumb to consider everything has this starting point unless you design and build the entire hardware and software stack to ensure nothing like this can be done. But you’ll never be able to sell it.
@Sibbo I do not see any problem with Letsencrypt. Any CA which is widely trusted has to follow the same rules. This rules are set up by the CA Browser Forum. Which metadata does LE collect? My server’s IP address, domain and subdomain, mail address. These are logged in the CT logs. Every CA has to log all certificates in a public CT log. Regardless which CA I choose, these data are public. There are not any critical data or metadata that LE can collect.
Letsencrypt can be directly forced to revoke certificates by the US. Organisations outside of the US are less vulnerable against that.
And ICAAN can hand your domain over to US law enforcement regardless of the TLD and your register.
Is that also part of your decision tree?
Maybe it should be! We need non-fascis-adjacent DNS roots.
