As I've discussed before, this site uses an SSL certificate from Let's Encrypt. Overall I believe they are doing the world a great service by offering certificates for free, but some recent events may be demonstrating a grave problem with their approach—and maybe even with the broader approach taken by implementations of SSL in general. To wit, the recent talk of 14,000 fake-PayPal phishing sites using valid SSL certificates from Let's Encrypt has brought to the forefront what is to my mind one of the potentially fatal flaws in the way we handle encrypted traffic over the Web: the fact that encryption and trust have somehow gotten lumped together as a single monolithic thing in the eyes of most consumers. If a site has a green lock, it's "safe," and that's all there is to it. Unfortunately, binary representations are just not a great way to look at complex systems like the Web.
A malicious actor can send you encrypted packets until the cows come home, and yet present himself as PayPal or Bank of America via a misleading URL. On the other hand, a certificate might just as easily be doing its job of proving the identity of a host machine even if the TLS encryption settings are weaker than gas-station coffee. It just seems obvious that a single icon with two states (red lock / green lock) is not a good way of indicating the complicated interplay between encryption and identity that SSL certificates attempt to address.
It seems reasonable to call for Let's Encrypt to do more to ensure a cert is not being issued to a clearly fraudulent domain (like one that's using "paypal.com" in its URLs). It also seems somewhat reasonable to hope that browser developers will begin to rethink the overly simplistic, unnecessarily binary colored-lock scheme which tries to serve as a catch-all for indicating a secure connection.
It pains me to say this, because I think in the aggregate, we're all better off if most traffic on the Web is encrypted—and free certificates are the only way that's ever going to happen. However, unless Let's Encrypt addresses the phishing potential inherent in their approach, I will have to have a good, long think about whether or not their certificates are a good fit for what we are hoping to build with LinkLocker.