3 ms·
Isn't that insecure because hostnames are sent in the clear? (both in TLS handshake and DNS lookup?)
by collinmanderson 10y ago
Isn't that insecure because hostnames are sent in the clear? (both in TLS handshake and DNS lookup?)
- icebraining 10y agoThe hostnames aren't authentication, just another layer of defense, mostly against JavaScript attacks (e.g. from hacked applications): https://docs.sandstorm.io/en/latest/administering/wildcard/#why-a-new-hostname-for-every-session-rather-than-for-every-document https://docs.sandstorm.io/en/latest/administering/wildcard/#...
- kentonv 10y agoRight, this is about mitigating the damage when apps have a bug -- risk management. Instead of being exploitable from anywhere on the internet, the bug becomes exploitable only by attackers who have a passive network MITM, which, while possible, is a very high barrier.