News for hackers. Stuff that matters.

A comment on Ask HN: For a startup which SSL certificate authority would you recommend & why?. Parent comment

Re:Ask HN: For a startup which SSL certificate authority wou... by skrish on Monday January 02, 2012 @02:54AM (#3415192)
Thanks. For my SAAS app where I need to issue <<customername>>.<<mydomain>>.com it will be very expensive to start with if I do not go for wildcard.

I understand the risk & re-certification issue and will look into this further.

[ Parent | on HN ]
Re:Ask HN: For a startup which SSL certificate authority wou... by marshray on Monday January 02, 2012 @03:07AM (#3415217)
You should fully understand the same-origin implications of such a design before deploying it.

For example, if <<customername>> is able to set cookies or run script (e.g., via XSS), they will be able to set cookies that affect everything under <<mydomain>>.com. Under some circumstances they will even be able to read back the values.

Here's a good site to keep you awake at night: http://lcamtuf.blogspot.com/2010/10/http-cookies-or-how-not-...

[ Parent | on HN ]