: most Let's Encrypt (and other Domain Validated) certificates are issued to junk- or plain criminal websites.

They're the ultimate manifestation of evil big tech.

They were introduced to encrypt the "last mile" because Internet Service Providers were replacing ads in webpages and, in the other direction, inserting fake clicks.

DV has destroyed the internet. People loose their ebank savings and companies get ransomwared; phishing is dead simple. EDIW/EUDIW will become an identity fraud disaster (because of AitM phishing atracks).

Even the name "Let's Encrypt" is wrong for a CSP: nobody needs a certificate to encrypt a connection. The primary purpose of a certificate is AUTHENTICATION (of the owner of the private key, in this case the website).

However, for human beings, just a domain name simply does not provide reliable identification information. It renders impersonation a peace of cake.

Decent online authentication is HARD. Get used to it instead of denying it.

REASONS/EXAMPLES

🔹 Troy Hunt fell in the DV trap: infosec.exchange/@ErikvanStrat…

🔹 Google (and Troy Hunt!) killed non-DV certs (for profit) because of the stripe.com PoC. Now Chrome does not give you any more info than what Google argumented: infosec.exchange/@ErikvanStrat…

🔹 https:⧸⧸cancel-google.com/captcha was live yesterday: infosec.exchange/@ErikvanStrat…

🔹 Stop phishing proposal: infosec.exchange/@ErikvanStrat…

🔹 Lots of reasons why LE sucks:
infosec.exchange/@ErikvanStrat… (corrected link 09:20 UTC)

🔹 This website stopped registering junk .bond domain names, probably because there were too many every day (the last page I found): newly-registered-domains.abtdo…. However, this gang is still active, open the RELATIONS tab in virustotal.com/gui/ip-address/…. You have to multiply the number of LE certs by approx. 5 because they also register subdomains and don't use wildcard certs. Source: bleepingcomputer.com/news/secu…

@EUCommission @letsencrypt @nlnet

#Authentication #Impersonation #Spoofing #Phishing #DV #GoogleIsEvil #BigTechIsEvil #Certificates #httpsVShttp #AitM #MitM #FakeWebsites #CloudflareIsEvil #bond #dotBond #Spam #Infosec #Ransomware #Banks #CloudflareIsEvil #FakeWebsites

Here's my post on the court injunction my site got hit with:

HCRG Care's lawyers claimed an injunction issued in a "private" hearing required us to remove two posts. We didn't comply.

HCRG Care was represented by the Pinsent Masons law firm in the UK in this matter. The injunction was issued by the High Court of Justice, King's Bench Division, Media and Communications List by the Honorable Mr. Justice Soole.

Pinsent Mason's attempt to get my web host to remove my posts also failed.

As always, I feel blessed to have the legal support of Covington and Burling's Kurt Wimmer Pro Media Freedom Initiative, which has represented my site pro bono for the last 16 years.

Read about the letter, the injunction, and why the High Court's over-reaching injunction endangers UK journalists and doesn't serve the public well.

databreaches.net/2025/03/05/hc…

Oh, and I'm not the only one ignoring the injunction. Medusa also got served with the injunction via tox chat, they tell me. And like other injunctions they have received, they are ignoring it. So what has HCRG really accomplished?

#databreach #ransomware #Medusa #transparency #censorship #pressfreedom #injunction #FirstAmendment

@zackwhittaker @campuscodi @lawrenceabrams @iainthomson
@amvinfe @lawfare @freedomofpress