News for hackers. Stuff that matters.

A comment on Cname cloaking, a disguise of third-party trackers.

Re:Cname cloaking, a disguise of third-party trackers by air7 on Sunday November 24, 2019 @08:48AM (#21620382)
Something is missing here: HTTPS links and SSL. Either website.com hands over its certificate to dnsdelegation.io (which is unlikely and definitely not a 2 min trust-less process) or dnsdelegation.io has the ability to generate any certificate like a certificate authority which is really terrible (and also unlikely).
[ Parent | on HN ]
Re:Cname cloaking, a disguise of third-party trackers by poitrus on Sunday November 24, 2019 @01:38PM (#21622328)
With ACME enabled CAs like letsencrypt, having a domain pointing to an IP you control is all you need to obtain a valid certificate.
[ Parent | on HN ]
Re:Cname cloaking, a disguise of third-party trackers by hiciu on Sunday November 24, 2019 @09:23AM (#21620591)
DV certificate (cheapest, most common one) does require only proof of control over the domain.

So dnsdelegation.io can just request certificate for the domain you've delegated via cname from any CA.

[ Parent | on HN ]
Re:Cname cloaking, a disguise of third-party trackers by sildur on Sunday November 24, 2019 @09:59AM (#21620778)
They are (ab)using let’s encrypt.
[ Parent | on HN ]