4 ms·

It is kind of a bummer that I can't have a website flying under the radar (given a requirement to have a cert signed by a well-known CA). There is a subset of

It is kind of a bummer that I can't have a website flying under the radar (given a requirement to have a cert signed by a well-known CA). There is a subset of personal websites that I have rather not have poked and prodded by everyone, yet still be able to casually access them from random places.

judge2020 3y ago
You could still used a self-signed certificate, you would just need to view the certificate anytime you’re on someone else’s machine to check its validity. And you can always use wildcard certificates to keep hostnames secret.
moehm 3y ago
You can host it under a subdomain secret.example.com and have a single wildcard cert for *.example.com. You can't hide that example.com exists, but you can hide all subdomains for that domain.
diarrhea 3y ago
Other than wildcard certs mentioned by sibling comments, note that this is security by obscurity in pure form. This is insecure! You cannot have a website on the public internet and hope to hide it only by virtue of having no well-known CA cert. Your deployment, should it be truly public, has to be secure even in the face of its location (FQDN) being known. Else, it’d just be a matter of time until breaching happens. You might be interested in the ACME DNS challenge as well.
- mschuster91 3y ago
  > Other than wildcard certs mentioned by sibling comments, note that this is security by obscurity in pure form. This is insecure! I prefer defense in depth, and it starts with not having all kinds of stuff publicly visible on Shodan with zero effort required for an attacker.
  - tialaramex 3y ago
    Note that Bulk DNS Records are a very affordable service. I don't know if Shodan throws those in, it may not, but if your attacker isn't a bored teenager who took a momentary interest they absolutely do have those records. If you can afford Netflix you can afford to subscribe to that data from a reputable supplier. The way they're obtained is, if you operate a huge public DNS service, you collect the set of answers you saw, with timestamps but no PII, and you just sell that. If you take this data from a handful of the biggest DNS services you've got maybe 95% coverage of everything out there. Sure 99% of users of hr.big-bank.example will be Big Bank employeees at work with local DNS, but 1% is people who are at home, or off-site or whatever and maybe it doesn't even work without VPN, but someone will click it by accident and so it gets collected.
    - mschuster91 3y ago
      What, excuse me, the fuck. This should not be legal at all.
champtar 3y ago
Just use a secret path, subdomain will always leak via DNS. You can also disable access logs on anything else than the secret path and cut the noise drastically.

judge2020 3y ago

You could still used a self-signed certificate, you would just need to view the certificate anytime you’re on someone else’s machine to check its validity. And you can always use wildcard certificates to keep hostnames secret.

moehm 3y ago

You can host it under a subdomain secret.example.com and have a single wildcard cert for *.example.com. You can't hide that example.com exists, but you can hide all subdomains for that domain.

diarrhea 3y ago

Other than wildcard certs mentioned by sibling comments, note that this is security by obscurity in pure form. This is insecure! You cannot have a website on the public internet and hope to hide it only by virtue of having no well-known CA cert. Your deployment, should it be truly public, has to be secure even in the face of its location (FQDN) being known. Else, it’d just be a matter of time until breaching happens. You might be interested in the ACME DNS challenge as well.

mschuster91 3y ago
> Other than wildcard certs mentioned by sibling comments, note that this is security by obscurity in pure form. This is insecure! I prefer defense in depth, and it starts with not having all kinds of stuff publicly visible on Shodan with zero effort required for an attacker.
- tialaramex 3y ago
  Note that Bulk DNS Records are a very affordable service. I don't know if Shodan throws those in, it may not, but if your attacker isn't a bored teenager who took a momentary interest they absolutely do have those records. If you can afford Netflix you can afford to subscribe to that data from a reputable supplier. The way they're obtained is, if you operate a huge public DNS service, you collect the set of answers you saw, with timestamps but no PII, and you just sell that. If you take this data from a handful of the biggest DNS services you've got maybe 95% coverage of everything out there. Sure 99% of users of hr.big-bank.example will be Big Bank employeees at work with local DNS, but 1% is people who are at home, or off-site or whatever and maybe it doesn't even work without VPN, but someone will click it by accident and so it gets collected.
  - mschuster91 3y ago
    What, excuse me, the fuck. This should not be legal at all.

champtar 3y ago

Just use a secret path, subdomain will always leak via DNS. You can also disable access logs on anything else than the secret path and cut the noise drastically.