4 ms·

Is this true? Are you implying bitwarden doesn't respect the PSL? It seems like it does.

• jeroenhd 6y ago
  The PSL is not a real solution to this threat, though it does protect a lot of high profile websites; it's a useful tool, but by no means a complete solution to subdomain attacks. With cloud platforms like Azure it's possible for a dangling subdomain to be taken over[1], for example; sure, that's preventable, but it still poses a risk. As I've said in another comment, many educational facilities also offer subdomains or shared hosting space for students and working groups. An attacker with control over evil.student.university.edu could steal university.edu credentials and use them for all kinds of nasty things like identity theft and blackmail. Theoretically this could be solved by adding all of these domains to the PSL, but there's more universities in the world than people using PSL so good luck with that. You also risk breaking educational utilities with uninformed listings so you'd need a list from the IT facilitators to be sure about listing something in the PSL. I don't think it's going to happen, and I wouldn't assume the PSL is a waterproof security tool for these kinds of risks. [1]: https://blog.cystack.net/subdomain-takeover-chapter-two-azure-services/ https://blog.cystack.net/subdomain-takeover-chapter-two-azur...
  • EE84M3i 6y ago
    I agree completely. However, you listed "Github pages" in your examples which is very well known to be on the PSL.