Thanking the @letsencrypt folks for the excellent work they do, and especially for their upcoming support for security certificates for IP addresses which is nothing short of revolutionary for the future of the (Small) Web.
community.letsencrypt.org/t/ge…
#SmallWeb #security #IPAddresses #WebNumbers #LetsEncrypt #SmallTech #decentralisation #peerToPeerWeb #findability
Getting ready to issue IP address certificates
Happy to see the progress on this. Thought you might be interested in seeing how important this feature is going to be for the Small Web: It’s going to be invaluable for helping decentralise the web. Thank you for the work you do 🙂Let's Encrypt Community Support
This entry was edited (1 month ago)
![Antireport [Bot]](images/default/mastodon.png)
wandi
in reply to Aral Balkan • • •Perhaps to avoid misunderstanding of commutation..
A web number is a IP address.
An IP address is not a web number.
Aral Balkan
in reply to wandi • • •@telmi Good point.
Maybe I’ll add something along the lines of “Every Web Number is an IP Address but not every IP address is a Web Number.” 😀
Aral Balkan
Unknown parent • • •Aral Balkan
Unknown parent • • •SpaceLifeForm
in reply to Aral Balkan • • •Interesting. No wonder that they will stop the email warnings for certs close to expiry.
Probably will be useless if you have to deal with CGNAT.
Aral Balkan
in reply to SpaceLifeForm • • •SpaceLifeForm
in reply to Aral Balkan • • •Exactly. I can not imagine many are still doing the manual process any longer.
Imagine if certs only lasted a day.
Actually, don't imagine it. It is a horrible idea even if automated.
Erik van Straten
in reply to Aral Balkan • • •: what a brilliant idea!
*NOT*
Meaningless, unreadable & impossible to remember long domain names that do not fit in address bars of mobile browsers...
And adding '[' and ']' to make even more people skip reading address bars because they don't understand what's in it.
Phishers will love them though.
@letsencrypt
#Phishing
Aral Balkan
in reply to Erik van Straten • • •Did you read the linked article? No one’s going to be entering IP addresses manually into their address bar. Everyone will be using personal address books, like a phone book.
Also, it’s for personal sites on the *Small Web* operating within the bounds of a web of trust. If your friends and family are trying to phish you, you have bigger problems.
ar.al/2025/06/25/web-numbers/
Web Numbers
Aral BalkanErik van Straten
in reply to Aral Balkan • • •wrote: "If your friends and family are trying to phish you, you have bigger problems."
Phishing means that an adversary *claiming to be* someone you know (including friends and family) convinces you to click on a link.
The purpose of a certificate, telling a receiver *WHO* (human readable) owns the associated private key (the last resort to distinguish between fake and authentic), now has completely vanished.
As if phishing is not already the nr. 1 problem on the internet.
Note: I'm fine with the idea provided that browsers clearly inform users about the reliability of authenticity (I've read your article, did you read infosec.exchange/@ErikvanStrat… ?)
@letsencrypt
#Phishing #LetsEncrypt #DNS #DomainNames #Identification #Authentication
Erik van Straten (@ErikvanStraten@infosec.exchange)
Infosec ExchangeAral Balkan
in reply to Erik van Straten • • •@ErikvanStraten Yeah, a security certificate doesn’t guarantee who owns a particular end point, only that the entity that controls it has access to the private key that was used when the certificate was issued so as to mitigate MITM attacks.
As far as the Small Web is concerned, that’s a fact of life we have to contend with (I’d much prefer a decentralised system like DANE had succeeded) but I definitely don’t want more hurdles and/or information. You want to be anonymous on your personal site? Go right ahead. There’s no reason to prove that a person quite possible exploring an aspect of themselves at rainbows-and-butterflies.org is actually Jane Someone.
We just have different use cases, basically.
Erik van Straten
in reply to Aral Balkan • • •: different use cases indeed, but for ordinary end users there is no way to reliably distinguish between them - unless a different browser would be needed.
Unreadable domain names will make even more people skip looking at their browsers address bar.
A (quick&dirty) mockup of what I'd like browsers to show in case of an IPv6 address, can be seen below (of course I'm fully open to discussion regarding layout, contents and the "one year" period).
Note: important is that the user can distinguish between such information provided by the browser, to not be fooled by a webpage that fakes such info (how is probably device-, OS- and browser-dependent).
If ownership information *is* available in the certificate, the browser should show that - and provide an indication of the *reliability* of such information.
@letsencrypt
#Phishing #PhishingPrevention #SecureTheInternet #SaferInternet