Let's Encrypt root certificate trusted by Mozilla

Re:Let's Encrypt root certificate trusted by Mozilla by aroch on Friday August 05, 2016 @12:54PM (#12233872)

Unless all your subdomains are unique (e.g. coming out of a PRNG) AND there are no public DNS entries for them, subdomain enumeration by DNS or IP space is super easy. Not using SAN because of info disclosure concerns is security through obscurity.

[ Parent | on HN ]

Re:Let's Encrypt root certificate trusted by Mozilla by kentonv on Friday August 05, 2016 @01:04PM (#12233958)

Well yes, that's the idea: Say you have a wildcard DNS entry and you cryptographically-randomly-generate hostnames in it, as an added layer of defense against CSRF bugs in the applications running on these hosts.

https://docs.sandstorm.io/en/latest/administering/wildcard/#...

[ Parent | on HN ]

Re:Let's Encrypt root certificate trusted by Mozilla by aroch on Friday August 05, 2016 @01:22PM (#12234123)

That doesn't prevent domain enumeration for your application though. Once you publish an application, anyone using it can find the address its hosted behind

[ Parent | on HN ]

Re:Let's Encrypt root certificate trusted by Mozilla by icebraining on Friday August 05, 2016 @01:35PM (#12234230)

> publish

Sandstorm is a platform for personal computing; each person runs their own applications, much like in a PC. Also, applications don't get hostnames; each document (or equivalent) in the application gets its own hostname.

[ Parent | on HN ]

Re:Let's Encrypt root certificate trusted by Mozilla by kentonv on Friday August 05, 2016 @03:26PM (#12235121)

It's even finer-grained than that. Each session gets a hostname -- if you open the same document twice, it's at a different hostname each time. This also implies that different users get different hostnames, so you can't discover the host another user sees even if you have access to the same document.

[ Parent | on HN ]

Re:Let's Encrypt root certificate trusted by Mozilla by collinmanderson on Sunday August 07, 2016 @09:00AM (#12241957)

Isn't that insecure because hostnames are sent in the clear? (both in TLS handshake and DNS lookup?)

[ Parent | on HN ]

Re:Let's Encrypt root certificate trusted by Mozilla by icebraining on Sunday August 07, 2016 @01:51PM (#12242868)

The hostnames aren't authentication, just another layer of defense, mostly against JavaScript attacks (e.g. from hacked applications): https://docs.sandstorm.io/en/latest/administering/wildcard/#...

[ Parent | on HN ]

Re:Let's Encrypt root certificate trusted by Mozilla by kentonv on Sunday August 07, 2016 @03:24PM (#12243258)

Right, this is about mitigating the damage when apps have a bug -- risk management. Instead of being exploitable from anywhere on the internet, the bug becomes exploitable only by attackers who have a passive network MITM, which, while possible, is a very high barrier.

[ Parent | on HN ]

Re:Let's Encrypt root certificate trusted by Mozilla by tracker1 on Friday August 05, 2016 @06:31PM (#12236143)

For such applications, there are plenty of relatively inexpensive paid options for wildcard certs. I don't think this is something Let's Encrypt should solve. I'd rather see them invest more time into supporting dynamic dns provider domains better, which imho is a much larger issue for small/hobby/free projects.

[ Parent | on HN ]

Re:Let's Encrypt root certificate trusted by Mozilla by patates on Saturday August 06, 2016 @02:13AM (#12237268)

I'm ready to pay a reasonable amount for a wildcard cert to use with some hobby projects. Is there a trustworthy cheap wildcard cert provider which is not Comodo?

[ Parent | on HN ]

Re:Let's Encrypt root certificate trusted by Mozilla by gnyman on Saturday August 06, 2016 @10:21AM (#12238192)

Have you checked StartSSL? They've worked fine for me.

[ Parent | on HN ]

Re:Let's Encrypt root certificate trusted by Mozilla by icebraining on Saturday August 06, 2016 @03:28AM (#12237396)

What's the problem with dynamic dns provider domains?

[ Parent | on HN ]

Re:Let's Encrypt root certificate trusted by Mozilla by tracker1 on Monday August 08, 2016 @01:12AM (#12245628)

I mean domains on no-ip, freedns, dyndns and the like.. that are subdomains are more likely to hit the default limits with Let's Encrypt... I'd like to see some auto-whitelisting for some of the more popular ones.

[ Parent | on HN ]

Re:Let's Encrypt root certificate trusted by Mozilla by x1798DE on Friday August 05, 2016 @09:29PM (#12236638)

I thought sandstorm was a self-hosted thing. Why do the certs need to be signed by a public CA at all? A self-signed certificate is fine (and in some ways better than a public CA) when you can verify the source yourself because you generated it.

[ Parent | on HN ]

Re:Let's Encrypt root certificate trusted by Mozilla by kentonv on Friday August 05, 2016 @09:40PM (#12236662)

Sure, you can use a self-signed cert, if you don't mind going through the process of installing the cert into every browser that you'll use to access the server.

But Sandstorm is designed for sharing and collaboration. For example, you might write a document in Etherpad which you want other people to comment on. It may be tough to get the right certificate into all your friends' and family's browsers.

(Note that Sandstorm actually provides free wildcard certificates if you are OK with using a subdomain of sandcats.io.)

[ Parent | on HN ]

Re:Let's Encrypt root certificate trusted by Mozilla by aroch on Friday August 05, 2016 @03:20PM (#12235081)

At which point we're back to my original point of why does the information disclosure matter?

[ Parent | on HN ]

Re:Let's Encrypt root certificate trusted by Mozilla by kentonv on Friday August 05, 2016 @03:28PM (#12235131)

Defense-in-depth against CSRF attacks, which are still way too common. Sandstorm can't security-review the apps for you but it can mitigate most vulnerabilities.

[ Parent | on HN ]

Re:Let's Encrypt root certificate trusted by Mozilla by LinuxBender on Friday August 05, 2016 @06:36PM (#12236160)

I would like to add that security through obscurity is not bad when it used as layers in the security cake. Delicious red velvet cake with cool fluffy chocolate frosting and a side of ice cream.

[ Parent | on HN ]

Re:Let's Encrypt root certificate trusted by Mozilla by Jweb_Guru on Friday August 05, 2016 @01:08PM (#12234011)

If it doesn't count as secure unless there's perfect information transparency, most of cryptography is based on "security through obscurity."

[ Parent | on HN ]