Re:Let's Encrypt root certificate trusted by Mozilla
by kentonv on Friday August 05, 2016 @03:26PM
(#12235121)
It's even finer-grained than that. Each session gets a hostname -- if you open the same document twice, it's at a different hostname each time. This also implies that different users get different hostnames, so you can't discover the host another user sees even if you have access to the same document.
[ Parent
| on HN ]
Re:Let's Encrypt root certificate trusted by Mozilla
by collinmanderson on Sunday August 07, 2016 @09:00AM
(#12241957)
Isn't that insecure because hostnames are sent in the clear? (both in TLS handshake and DNS lookup?)
Re:Let's Encrypt root certificate trusted by Mozilla
by icebraining on Sunday August 07, 2016 @01:51PM
(#12242868)
The hostnames aren't authentication, just another layer of defense, mostly against JavaScript attacks (e.g. from hacked applications): https://docs.sandstorm.io/en/latest/administering/wildcard/#...
Re:Let's Encrypt root certificate trusted by Mozilla
by kentonv on Sunday August 07, 2016 @03:24PM
(#12243258)
Right, this is about mitigating the damage when apps have a bug -- risk management. Instead of being exploitable from anywhere on the internet, the bug becomes exploitable only by attackers who have a passive network MITM, which, while possible, is a very high barrier.