5 ms·
I hope you don't publish that record to the world.
by rblatz 9y ago
I hope you don't publish that record to the world.
- icebraining 9y agoWhy?
- brazzledazzle 9y agoJust a guess: CORS-related attacks
- icebraining 9y agoHow would that work?
- deleted 9y ago[deleted]
- IshKebab 9y agoI guess anyone on 127.0.0.1 can pretend to that address. Very unlikely to matter.
- jwilk 9y agoSame-site scripting: http://seclists.org/bugtraq/2008/Jan/270 http://seclists.org/bugtraq/2008/Jan/270
- icebraining 9y agoInteresting. Still, that requires the attacker to be already running a process on the victim's machine, even if with reduced privileges. Nowadays that's rare, since there's no reason not to give each user its own network namespace, at the very least.
- piscisaureus 9y agoIt's already been done: https://git.daplie.com/Daplie/localhost.daplie.me-certificates#https-certs-for-localhost-development https://git.daplie.com/Daplie/localhost.daplie.me-certificat... Which I find to be a very practical solution for connecting to localhost over https, it frees you from having to install a self-signed certificates/CAs on your machine.
- 0x0 9y agoNot a great idea to publish private keys for valid certificates. Anyone could probably submit a certificate revocation request to the CA, as the key would be considered compromised.
- jaas 9y agoPublishing private keys is a violation of the Let's Encrypt terms of service. We are revoking these certificates. https://letsencrypt.org/documents/LE-SA-v1.1.1-August-1-2016.pdf https://letsencrypt.org/documents/LE-SA-v1.1.1-August-1-2016...
- Spivak 9y agoLots of sites seem to be doing it now. Off the top of my head I know that Box and Spotify both do it.