4 ms·

TLDR: When you add a CA certificate, you're announcing to the world "hey look at me, I'm probably a new site, with probably not a lot of security practices cove

by javchz 4y ago

TLDR: When you add a CA certificate, you're announcing to the world "hey look at me, I'm probably a new site, with probably not a lot of security practices covered" and if you use WordPress, you could be victim of automated attacks. In defence of WP this could happen to any CMS, but wp it's the most popular by far

tialaramex 4y ago
Note that you're also announcing to the world "Hey look at me, I'm probably a new site" when you publish DNS records and then anybody looks at them via most public DNS resolvers. Passive DNS is the product e.g. https://www.circl.lu/services/passive-dns/ https://www.circl.lu/services/passive-dns/ https://www.farsightsecurity.com/technical/passive-dns/passive-dns-faq/ https://www.farsightsecurity.com/technical/passive-dns/passi... https://www.anomali.com/blog/introduction-to-passive-dns-usage-in-threatstream https://www.anomali.com/blog/introduction-to-passive-dns-usa... Unsurprisingly lots of outfits want to publicly advertise this as a white hat feature you can purchase from them, but it's just technology, it works fine for bad guys too.
- mschuster91 4y ago
  > Note that you're also announcing to the world "Hey look at me, I'm probably a new site" when you publish DNS records and then anybody looks at them via most public DNS resolvers. "Publish DNS records" does not exist. There is no sort of "firehose" where anyone can subscribe to a feed of newly registered domains.
  - blibble 4y ago
    companies running most zonefiles let you buy it, as well as various statistics
    - duskwuff 4y ago
      Access to zone files is relatively restricted (you have to give the registry a good reason you need the data), and is a daily report, not a real-time feed.
- prepend 4y ago
  I run the prepend.com domain. I don’t think there’s any way for you, or anyone without admin access to my dns server, to know when I add a CNAME record for tialaramex.prepend.com. I guess someone could continuously request every possible entry over and over to see when I do that, but don’t think it’s likely.
  - tialaramex 4y ago
    Passive DNS doesn't request every possible entry. What happens is that when say, somebody uses their AT&T phone to ask A? tialaramex.prepend.com the AT&T DNS servers tell them that's 10.20.30.40 and the AT&T DNS servers tell a passive DNS outfit, "At 18:26 UTC the answer to A? tialaramex.prepend.com was apparently 10.20.30.40" Now, I'm sure that lots of HN readers have a local manually configured DNS resolver that of course isn't feeding passive DNS. And some of them might even have an upstream DNS resolver which is bootstrapped and that too does not feed passive DNS. It's not even difficult if you were insistent upon doing it. But, the design guy's iPhone which he used to take a quick screenshot? Probably just uses a public DNS resolver. The woman who trains front line support and asked for a sneak peak ready to start training on the new site? She probably has 8.8.8.8 set as her DNS resolver. So just like asking for the publicly trusted certificate, this is another way that your DNS names go from "Nobody would guess what that is" to public knowledge in seconds once they leave your hands.

by javchz 4y ago

tialaramex 4y ago

Note that you're also announcing to the world "Hey look at me, I'm probably a new site" when you publish DNS records and then anybody looks at them via most public DNS resolvers. Passive DNS is the product e.g. https://www.circl.lu/services/passive-dns/ https://www.circl.lu/services/passive-dns/ https://www.farsightsecurity.com/technical/passive-dns/passive-dns-faq/ https://www.farsightsecurity.com/technical/passive-dns/passi... https://www.anomali.com/blog/introduction-to-passive-dns-usage-in-threatstream https://www.anomali.com/blog/introduction-to-passive-dns-usa... Unsurprisingly lots of outfits want to publicly advertise this as a white hat feature you can purchase from them, but it's just technology, it works fine for bad guys too.

mschuster91 4y ago
> Note that you're also announcing to the world "Hey look at me, I'm probably a new site" when you publish DNS records and then anybody looks at them via most public DNS resolvers. "Publish DNS records" does not exist. There is no sort of "firehose" where anyone can subscribe to a feed of newly registered domains.
- blibble 4y ago
  companies running most zonefiles let you buy it, as well as various statistics
  - duskwuff 4y ago
    Access to zone files is relatively restricted (you have to give the registry a good reason you need the data), and is a daily report, not a real-time feed.
prepend 4y ago
I run the prepend.com domain. I don’t think there’s any way for you, or anyone without admin access to my dns server, to know when I add a CNAME record for tialaramex.prepend.com. I guess someone could continuously request every possible entry over and over to see when I do that, but don’t think it’s likely.
- tialaramex 4y ago
  Passive DNS doesn't request every possible entry. What happens is that when say, somebody uses their AT&T phone to ask A? tialaramex.prepend.com the AT&T DNS servers tell them that's 10.20.30.40 and the AT&T DNS servers tell a passive DNS outfit, "At 18:26 UTC the answer to A? tialaramex.prepend.com was apparently 10.20.30.40" Now, I'm sure that lots of HN readers have a local manually configured DNS resolver that of course isn't feeding passive DNS. And some of them might even have an upstream DNS resolver which is bootstrapped and that too does not feed passive DNS. It's not even difficult if you were insistent upon doing it. But, the design guy's iPhone which he used to take a quick screenshot? Probably just uses a public DNS resolver. The woman who trains front line support and asked for a sneak peak ready to start training on the new site? She probably has 8.8.8.8 set as her DNS resolver. So just like asking for the publicly trusted certificate, this is another way that your DNS names go from "Nobody would guess what that is" to public knowledge in seconds once they leave your hands.