I recently almost got caught by a phishing attempt, due to the use of a relatively convincing domain name and valid SSL certificate (specifically this website). When checking the certificate it turns out it was issued by Let's Encrypt. So I went there and as far as I understand the process to issue a certificate is automated - if you own a domain, you can get a certificate.

However isn't it a security issue and doesn't it go (at least partially) against the point of SSL certificates? Malicious websites can now look legitimate thanks to these certificates, which makes it a lot more likely that they will succeed. In my case I saw the green padlock on the URL and thought that all was good. Now it seems, due to this certificate issuer, users will be expected to click on that padlock and check who issued the certificate (and close the tab if it's from letsencrypt??).

So I'm wondering, given the security risk, why do browsers accept this certificate by default? I'm surprised especially that Chrome does given how careful Google is with security. Do they consider that letsencrypt is a good idea?

I think you are misunderstanding what a SSL certificate actually certifies, and what it is designed to protect against.

A standard certificate only certify that the owner of the certificate actually controls the domain in question. So a certificate for g00dbank.com only certifies that the owner controls the g00dbank.com domain. It does not certify that the owner is a bank, that she is good, or that the site is in fact the well known Good Bank Incorporated.

So SSL is not designed to protect against phishing. Just because you see the green lock up in the left corner does not mean that everything is well. You also need to verify that you are on the correct website - that you are on goodbank.com (as opposed to the phishy g00dbank.com) and that goodbank.com is in fact the website of Good Bank Incorporated.

To make this easier for the average user, there is something called Extended Validation (EV) certificates. These also verify that you are the legal entity that you claim to be, by requiring you to do some paperwork. Most major browsers highlight them by displaying the name of the owner in the address bar.

So to get an EV certificate the phishers at g00dbank.com would have to start a real business (thereby leaving a paper trail), and even then they would probably not get one because their name is to close to a sensitive target.

Lets Encrypt does not issue EV certificates. They issue ordinary ones. But the phishers you encountered could have gotten a certificate from anywhere. In fact, as IMSoP points out in comments, the method Lets Encrypt uses is employed by many of the established CA:s as well, the only difference being that Lets Encrypt is more efficient and cheaper. So this has nothing to do with Lets Encrypt specifically, and blocking them would solve nothing.
