News for hackers. Stuff that matters.

A comment on Let's Encrypt tls-sni-01 disabled due to credible vulnerability report. Parent comment

Re:Let's Encrypt tls-sni-01 disabled due to credible vulnera... by vog on Wednesday January 10, 2018 @04:48AM (#16113708)
I see. So this is more to be interpreted as a rushed preliminary report, forced upon them by appearing at the HN front page, to prevent uninformed rumor to appear and to spread. Or, did I miss something?

EDIT: Apparently the latter didn't work, as the very first response to their comment starts with "Do we get points for speculation based on these hints? ..."

[ Parent | on HN ]
Re:Let's Encrypt tls-sni-01 disabled due to credible vulnera... by tialaramex on Wednesday January 10, 2018 @05:09AM (#16113798)
It prevented _uninformed_ rumours :D

Almost all the speculation was about the exact scenario that Let's Encrypt have subsequently confirmed - you can trick some bulk hosting or CDN providers into letting you (a customer) answer a challenge for one of their other customers' systems.

[ Parent | on HN ]