Lets encrypt twitter precense

No doubt. But here are some points you don't seem to be accounting for:

  • LE has long taken the position that it isn't properly the role of the CA to be the spam/scam police. Initially, they ran new cert requests against the Google Safe Browsing list, but IIRC they've long since ceased to do that. If you can demonstrate domain control, you get a cert. Their position statement on this has been linked up-topic, and this has been the subject of extensive discussion here (see, e.g., here, here, and here).
  • Similarly, LE doesn't revoke certs simply because bad people are using them, or are using them for bad purposes. They revoke in the case of mis-issuance, or on subscriber request.
  • Certificate revocation is pretty badly broken in any event, so revoking the cert doesn't do much to help out.
  • Your request (which sounded much more like a demand) was that LE adopt a new support channel, with dedicated personnel to monitor it, to do something they've long since said they don't do in the first place, and without any apparent consideration (or even awareness) of the foregoing points.

I guess there's some validity in the request that LE monitor Twitter mentions--for reasons that completely escape me, lots of people use it, and expect to be able to interact with businesses and organizations that way. But their response to all the reports you're talking about would be some version of "we don't do that. See https://letsencrypt.org/2015/10/29/phishing-and-malware.html."

6 Likes