4 ms·

Note that the article uses http://traefik.me/ http://traefik.me/, one of those sites that resolves all subdomains to localhost (like lvh.me, http://readme.local

Note that the article uses http://traefik.me/ http://traefik.me/, one of those sites that resolves all subdomains to localhost (like lvh.me, http://readme.localtest.me/ http://readme.localtest.me/, or http://local.gd/ http://local.gd/), so you don't need any "localhost subdomain resolution".

benatkin 3y ago
I thought Let's Encrypt wouldn't allow SSL certificates with public private keys. It defeats the purpose. Edit: indeed, it says this: > You warrant to ISRG and the public-at-large that You have taken, and You agree that at all times You will take, all appropriate, reasonable, and necessary steps to assure control of, secure, properly protect, and keep secret and confidential the Private Key corresponding to the Public Key in Your Certificate (and any associated activation data or device, e.g. password or token). https://letsencrypt.org/documents/LE-SA-v1.3-September-21-2022.pdf https://letsencrypt.org/documents/LE-SA-v1.3-September-21-20... via https://letsencrypt.org/repository/ https://letsencrypt.org/repository/
- tinco 3y ago
  If you click what looks like the link to the privkey it shows a warning encouraging you to not revoke the key with LetsEncrypt. I suppose a *.traefik.me is as untrustworthy as any other you don't the owner of, so it doesn't really matter that anyone can sign a key for it, anyone can already get a key for any untrustworthy domain name they could come up with via letsencrypt. So it's probably only a problem for people who use traefik.me, they might be tricked into thinking they're visiting their own locally hosted site, and instead might be man-in-the-middled. Though that's a fairly specific attack coming from an APT or as a means to escalation from someone who already gained access through other means.
  - benatkin 3y ago
    A phishing site with https://coinbase-support-172-67-207-118.traefik.me/ https://coinbase-support-172-67-207-118.traefik.me/ would be similar to some phishing domains I've seen, and have the lock. With the lock I'm sure it could trick some people.

benatkin 3y ago

I thought Let's Encrypt wouldn't allow SSL certificates with public private keys. It defeats the purpose. Edit: indeed, it says this: > You warrant to ISRG and the public-at-large that You have taken, and You agree that at all times You will take, all appropriate, reasonable, and necessary steps to assure control of, secure, properly protect, and keep secret and confidential the Private Key corresponding to the Public Key in Your Certificate (and any associated activation data or device, e.g. password or token). https://letsencrypt.org/documents/LE-SA-v1.3-September-21-2022.pdf https://letsencrypt.org/documents/LE-SA-v1.3-September-21-20... via https://letsencrypt.org/repository/ https://letsencrypt.org/repository/

tinco 3y ago
If you click what looks like the link to the privkey it shows a warning encouraging you to not revoke the key with LetsEncrypt. I suppose a *.traefik.me is as untrustworthy as any other you don't the owner of, so it doesn't really matter that anyone can sign a key for it, anyone can already get a key for any untrustworthy domain name they could come up with via letsencrypt. So it's probably only a problem for people who use traefik.me, they might be tricked into thinking they're visiting their own locally hosted site, and instead might be man-in-the-middled. Though that's a fairly specific attack coming from an APT or as a means to escalation from someone who already gained access through other means.
- benatkin 3y ago
  A phishing site with https://coinbase-support-172-67-207-118.traefik.me/ https://coinbase-support-172-67-207-118.traefik.me/ would be similar to some phishing domains I've seen, and have the lock. With the lock I'm sure it could trick some people.