8 ms·
Other than wildcard certs mentioned by sibling comments, note that this is security by obscurity in pure form. This is insecure! You cannot have a website on t
by diarrhea 3y ago
Other than wildcard certs mentioned by sibling comments, note that this is security by obscurity in pure form. This is insecure!
You cannot have a website on the public internet and hope to hide it only by virtue of having no well-known CA cert. Your deployment, should it be truly public, has to be secure even in the face of its location (FQDN) being known. Else, it’d just be a matter of time until breaching happens.
You might be interested in the ACME DNS challenge as well.
- mschuster91 3y ago> Other than wildcard certs mentioned by sibling comments, note that this is security by obscurity in pure form. This is insecure! I prefer defense in depth, and it starts with not having all kinds of stuff publicly visible on Shodan with zero effort required for an attacker.
- tialaramex 3y agoNote that Bulk DNS Records are a very affordable service. I don't know if Shodan throws those in, it may not, but if your attacker isn't a bored teenager who took a momentary interest they absolutely do have those records. If you can afford Netflix you can afford to subscribe to that data from a reputable supplier. The way they're obtained is, if you operate a huge public DNS service, you collect the set of answers you saw, with timestamps but no PII, and you just sell that. If you take this data from a handful of the biggest DNS services you've got maybe 95% coverage of everything out there. Sure 99% of users of hr.big-bank.example will be Big Bank employeees at work with local DNS, but 1% is people who are at home, or off-site or whatever and maybe it doesn't even work without VPN, but someone will click it by accident and so it gets collected.
- mschuster91 3y agoWhat, excuse me, the fuck. This should not be legal at all.