Hacker News new | ask | show | jobs
by meapix 3895 days ago
What kind of insurance does letsencrypt provide in case of data breach? isn't that the whole point of certificate authority?
2 comments

No that is not the entire point of a CA. The insurance that the big commercial CAs offer now is a farce. No end user has actually received the money for two reasons:

1. breaches that qualify are often written off by the underwriter as "gross negligence" or other such behavior which basically allows them to nullify the contracts and pay nothing

2. situations where the breach could be covered by the terms of the insurance are incredibly rare. Most situations where SSL compromise is at risk would not be covered. The insurance only helps you if the CA causes you damages through their own actions. In one of the most famous cases, the breach of the CA DigiNotar, the underwriter said that DigiNotar misrepresented themselves and invalidated all their policies.

That should be the job of an insurance company, not a certificate authority.

Also, an https cert has nothing to do with data breaches :)

Breach of the CA, not the web host. If the CA is breached there is no point to the encryption.
It wouldn't break encryption because you don't give away the private key when requesting a certificate from a CA.

It would definitively compromise the identity/trust part of it.

Let me rephrase with a quote from the public-key cryptography wiki:

"An attacker who could subvert any single one of those certificate authorities into issuing a certificate for a bogus public key could then mount a "man-in-the-middle" attack as easily as if the certificate scheme were not used at all."