3 ms·

It's interesting that CT effectively publishes all of your HTTPS endpoints. Using your example, it's possible to see a bunch of twitter hosts it might be hard t

It's interesting that CT effectively publishes all of your HTTPS endpoints. Using your example, it's possible to see a bunch of twitter hosts it might be hard to find otherwise. This effect of CT has been surprisingly uncontroversial, in contrast to DNSSEC where enumeration concerns have probably delayed adoption: https://www.cloudflare.com/dns/dnssec/dnssec-complexities-and-considerations/ https://www.cloudflare.com/dns/dnssec/dnssec-complexities-an... I suppose you can get around enumeration concerns with CT by using a wildcard cert. It's always seemed odd to me to worry about information in a public database like DNS being retrievable on bulk anyway - that approach is just security by obscurity.

tptacek 6y ago
DNSSEC enumeration also exposes all the hosts in your zone, and CT exposes only the hosts with publicly verifiable certificates.
funnybeam 6y ago
But not everyone uses wildcard certs so enumeration is a problem. Also lots of people use certs with internal hostnames on public servers (they shouldn’t but it does make some things easier and not everyone is aware of the security issues). When CT first came out I remember running searches for some of our client’s domains and being easily able to identify Exchange servers, RDP servers, etc along with the corresponding internal hostnames which makes it easy to identify potential targets for attack. Obscurity does have a role to play in security - leaving your front door unlocked is unlikely to be a problem but if you publish that information in a publicly searchable database then you are making yourself a target
PostPlummer 6y ago
It is the new "zone transfer" without the IP addresses :) There are companies that use private (not publicly resolvable) domains for which they create public certificates for internal hosts, that get published via CT. Nice for OpsSec sleuthing. Edit: how to find these "private domains"? Often public certificates contain more than one DNS names, of which one might be "private". YMMV

tptacek 6y ago

DNSSEC enumeration also exposes all the hosts in your zone, and CT exposes only the hosts with publicly verifiable certificates.

funnybeam 6y ago

But not everyone uses wildcard certs so enumeration is a problem. Also lots of people use certs with internal hostnames on public servers (they shouldn’t but it does make some things easier and not everyone is aware of the security issues). When CT first came out I remember running searches for some of our client’s domains and being easily able to identify Exchange servers, RDP servers, etc along with the corresponding internal hostnames which makes it easy to identify potential targets for attack. Obscurity does have a role to play in security - leaving your front door unlocked is unlikely to be a problem but if you publish that information in a publicly searchable database then you are making yourself a target

PostPlummer 6y ago

It is the new "zone transfer" without the IP addresses :) There are companies that use private (not publicly resolvable) domains for which they create public certificates for internal hosts, that get published via CT. Nice for OpsSec sleuthing. Edit: how to find these "private domains"? Often public certificates contain more than one DNS names, of which one might be "private". YMMV