News for hackers. Stuff that matters.

A comment on Let's Encrypt root certificate trusted by Mozilla. Parent comment

Re:Let's Encrypt root certificate trusted by Mozilla by collinmanderson on Sunday August 07, 2016 @09:00AM (#12241957)
Isn't that insecure because hostnames are sent in the clear? (both in TLS handshake and DNS lookup?)
[ Parent | on HN ]
Re:Let's Encrypt root certificate trusted by Mozilla by icebraining on Sunday August 07, 2016 @01:51PM (#12242868)
The hostnames aren't authentication, just another layer of defense, mostly against JavaScript attacks (e.g. from hacked applications): https://docs.sandstorm.io/en/latest/administering/wildcard/#...
[ Parent | on HN ]
Re:Let's Encrypt root certificate trusted by Mozilla by kentonv on Sunday August 07, 2016 @03:24PM (#12243258)
Right, this is about mitigating the damage when apps have a bug -- risk management. Instead of being exploitable from anywhere on the internet, the bug becomes exploitable only by attackers who have a passive network MITM, which, while possible, is a very high barrier.
[ Parent | on HN ]