3 ms·

OneLogin... you mean like the guys who can't setup SSL Certs correctly? https://www.pinterest.onelogin.com https://www.pinterest.onelogin.com

cyberpunk 10y ago
That seems a bit harsh, it's a wildcard cert on onelogin.com and they have a 'catch all' DNS on there which will break ssl for anything above that: https://massive.bag.of.dicks.pinterest.onelogin.com https://massive.bag.of.dicks.pinterest.onelogin.com Is www.pt.ol.com linked from anywhere?
- chris_wot 10y ago
  The fact they have a "catch all" DNS resolver for an SSL-based website that is an interface for admins and end users alike that is guaranteed to fail says a lot about their ability to sell a secure product.
  - cyberpunk 10y ago
    And how else would you let your users have a subdomain login url? Why bother generating specific certs and dns for each when you can just use the HOST header for the login and use a wildcard? This is totally common and used in a lot of places.. I mean: https://bigger.bag.of.dicks.signin.aws.amazon.com/ https://bigger.bag.of.dicks.signin.aws.amazon.com/
    - chris_wot 10y ago
      Because those Certs weren't designed for this scenario. The fact that you can create that domain name to resolve is funny. I can think of a few phishing schemes I could use with this, if I were so inclined.
      - cyberpunk 10y ago
        This was designed for exactly that sort of scenario. If you're runnin a SAAS then this is totally common practice, it's used by at least AWS, Slack, and GitHub off the top of my head.. Are you saying these companies are doing something stupid? How could you phish github or aws by using their dns/cert setup as they intended it to be used?
T-Winsnes 10y ago
That's more of the nature of SSL certs than their inability to set them up correctly. *.example.com covers www.example.com, but not www.something.example.com. And as far as i know, you can't get a "super wildcard" cert that allows that. If I'm wrong on the last point, please let me know, as I know a lot of people that will be very happy to find out! also, you can use https://pintrest.onelogin.com https://pintrest.onelogin.com ;)
- chris_wot 10y ago
  Yes, but they are resolving these names. In fact, they are resolving any names.

cyberpunk 10y ago

That seems a bit harsh, it's a wildcard cert on onelogin.com and they have a 'catch all' DNS on there which will break ssl for anything above that: https://massive.bag.of.dicks.pinterest.onelogin.com https://massive.bag.of.dicks.pinterest.onelogin.com Is www.pt.ol.com linked from anywhere?

chris_wot 10y ago
The fact they have a "catch all" DNS resolver for an SSL-based website that is an interface for admins and end users alike that is guaranteed to fail says a lot about their ability to sell a secure product.
- cyberpunk 10y ago
  And how else would you let your users have a subdomain login url? Why bother generating specific certs and dns for each when you can just use the HOST header for the login and use a wildcard? This is totally common and used in a lot of places.. I mean: https://bigger.bag.of.dicks.signin.aws.amazon.com/ https://bigger.bag.of.dicks.signin.aws.amazon.com/
  - chris_wot 10y ago
    Because those Certs weren't designed for this scenario. The fact that you can create that domain name to resolve is funny. I can think of a few phishing schemes I could use with this, if I were so inclined.
    - cyberpunk 10y ago
      This was designed for exactly that sort of scenario. If you're runnin a SAAS then this is totally common practice, it's used by at least AWS, Slack, and GitHub off the top of my head.. Are you saying these companies are doing something stupid? How could you phish github or aws by using their dns/cert setup as they intended it to be used?

T-Winsnes 10y ago

That's more of the nature of SSL certs than their inability to set them up correctly. *.example.com covers www.example.com, but not www.something.example.com. And as far as i know, you can't get a "super wildcard" cert that allows that. If I'm wrong on the last point, please let me know, as I know a lot of people that will be very happy to find out! also, you can use https://pintrest.onelogin.com https://pintrest.onelogin.com ;)

chris_wot 10y ago
Yes, but they are resolving these names. In fact, they are resolving any names.