3 ms·
Isn't this exactly what the blog post is saying not to do? > By introducing a domain name instead of an IP address, you make it possible for an attacker to Man
by progval 8y ago
Isn't this exactly what the blog post is saying not to do?
> By introducing a domain name instead of an IP address, you make it possible for an attacker to Man in the Middle (MitM) the DNS lookup and inject a response that points to a different IP address. The attacker can then pretend to be the local app and send fake responses back to the web app, which may compromise your account on the web app side, depending on how it is designed.
- hamandcheese 8y agoOnly if you ship the private key with your app. Otherwise the MITM will fail certificate validation.
- aethr 8y agoHow would you run a local HTTPS server without the private key?
- progval 8y agoThey get one private key per user, and send it to the client's device.
- ajnin 8y agoWhich "compromises" the key, according to current Certificate Authorities policies. Once again the problem boils down to CAs being the sole "anchors of trust" in the current certificate system.
- progval 8y agoThen they could have their server tunnel ACME challenges to the device, so the private key never leaves the device, but can still be signed.
- BillinghamJ 8y agoThe private key is generated on the client side, and signed by the certificate. Plex has an intermediate which they control to issue these. It would not pass normal validation processes.
- progval 8y agoOh, indeed.
- aethr 8y agoCouldn't the web app also verify that the localhost.example.com domain resolves to 127.0.0.1 before attempting a connection?