News for hackers. Stuff that matters.

A comment on Internet Draft: Let 'localhost' be localhost. Parent comment

Re:Internet Draft: Let 'localhost' be localhost by rblatz on Monday August 07, 2017 @04:36PM (#14951038)
I hope you don't publish that record to the world.
[ Parent | on HN ]
Re:Internet Draft: Let 'localhost' be localhost by piscisaureus on Monday August 07, 2017 @05:50PM (#14951563)
It's already been done: https://git.daplie.com/Daplie/localhost.daplie.me-certificat...

Which I find to be a very practical solution for connecting to localhost over https, it frees you from having to install a self-signed certificates/CAs on your machine.

[ Parent | on HN ]
Re:Internet Draft: Let 'localhost' be localhost by jaas on Tuesday August 08, 2017 @09:39AM (#14957674)
Publishing private keys is a violation of the Let's Encrypt terms of service. We are revoking these certificates.

https://letsencrypt.org/documents/LE-SA-v1.1.1-August-1-2016...

[ Parent | on HN ]
Re:Internet Draft: Let 'localhost' be localhost by 0x0 on Monday August 07, 2017 @07:54PM (#14952296)
Not a great idea to publish private keys for valid certificates. Anyone could probably submit a certificate revocation request to the CA, as the key would be considered compromised.
[ Parent | on HN ]
Re:Internet Draft: Let 'localhost' be localhost by icebraining on Monday August 07, 2017 @04:41PM (#14951076)
Why?
[ Parent | on HN ]
Re:Internet Draft: Let 'localhost' be localhost by IshKebab on Monday August 07, 2017 @05:22PM (#14951383)
I guess anyone on 127.0.0.1 can pretend to that address. Very unlikely to matter.
[ Parent | on HN ]
Re:Internet Draft: Let 'localhost' be localhost by jwilk on Monday August 07, 2017 @05:48PM (#14951545)
Same-site scripting:

http://seclists.org/bugtraq/2008/Jan/270

[ Parent | on HN ]
Re:Internet Draft: Let 'localhost' be localhost by icebraining on Monday August 07, 2017 @06:05PM (#14951651)
Interesting. Still, that requires the attacker to be already running a process on the victim's machine, even if with reduced privileges. Nowadays that's rare, since there's no reason not to give each user its own network namespace, at the very least.
[ Parent | on HN ]
Re:Internet Draft: Let 'localhost' be localhost by brazzledazzle on Monday August 07, 2017 @04:51PM (#14951153)
Just a guess: CORS-related attacks
[ Parent | on HN ]
Re:Internet Draft: Let 'localhost' be localhost by icebraining on Monday August 07, 2017 @05:08PM (#14951279)
How would that work?
[ Parent | on HN ]
Re:Internet Draft: Let 'localhost' be localhost by Spivak on Monday August 07, 2017 @09:14PM (#14952695)
Lots of sites seem to be doing it now. Off the top of my head I know that Box and Spotify both do it.
[ Parent | on HN ]