[teraflop]

Telling the browser to accept all self-signed certificates is a bad idea, because it's no more difficult for an attacker to create one of those than the legitimate domain owner. Let's Encrypt has at least two huge immediate benefits:

1) It does challenge-response domain validation from an external server. It's not enough for an attacker to intercept and modify traffic between the client and server -- they also have to control the route between the server and LE. This isn't an infallible check but it dramatically raises the difficulty of an attack, especially if the check is done from multiple independent locations.

2) LE supports Certificate Transparency, which means they verifiably log all certificates that they issue to multiple third-party observatories. Even if an attacker can bypass domain validation, they can't actually get a certificate without immediately making it obvious that they've done so, giving the server operator the chance to revoke the certificate and investigate (if they're paying attention).

[umaguma]

It sounds like domain registrars are being used to supplant the role of CA's?

This reminds me of the situation with email where if a user has not purchased a domain name, then it is nearly impossible for the user to send or recieve email without a third party "email provider".

Will encryption become the same? If at least one endpoint has not signed up with some third party (e.g., letsencrypt) _and_ purchased a domain name, then it becomes nearly impossible for two endpoints to encrypt traffic between them?

Will we ever again allow users to be fully empowered, _without the involvement of third party endpoints_ (CA's, domain regstrars, etc.), to send email, encrypt traffic, and all the other basic things one can do with a computer and an internet connection? Is it unfathomable that two parties connected to the internet might actually know and/or trust each other already, without involvement of a third party interloper?

Those are meant to be yes or no questions, or perhaps a rhetorical ones. No need to provide rationale. :)

[Vendan]

almost anyone can set up trivial end to end encryption using any number of methods without relying on outside agencies. SSH, VPN, PGP, the list goes on. The issue is getting a HTTPS cert trusted by the general public, which is a much harder problem. Before letsencrypt, you had to pay a CA to issue you a cert. For a DV cert, they verified that you had permission to get a cert through a small number of ways. Most involved just getting an email through the whois entry for your domain, or setting a specific entry in DNS. Those aren't any more "secure" then letsencrypt's methods. If anything, a letsencrypt cert is arguably MORE secure, as it only lasts 3 months, so the domain needs to be rechecked more often.

[ketralnis]

You can encrypt between end points using self signed certs or your own CA just fine, but without the CA system you'll need some other way to prove that the signer is who you think they are. This could be a phone call or whatever other method you like

[umaguma]

Yes! You got it!

[nly]

Where can I run queries against these verifiable logs for my domain?

[clinta]

https://crt.sh/?Identity=%25&iCAID=7395