VPN use is at an all-time high – but are people safe?

Re:VPN use is at an all-time high – but are people safe? by blueflow on Tuesday July 04, 2023 @09:37AM (#36586468)

Its already worse than that. Any provider sitting between you and LetsEncrypt could pass the HTTP challenge on your behalf and get themselves certified as your server.

[ Parent | on HN ]

Re:VPN use is at an all-time high – but are people safe? by rootusrootus on Tuesday July 04, 2023 @10:09AM (#36586918)

I'd love to hear how exactly they'd pull that off.

[ Parent | on HN ]

Re:VPN use is at an all-time high – but are people safe? by blueflow on Tuesday July 04, 2023 @10:28AM (#36587202)

In Linux, you can do a dstaddr/dstport based redirect in the iptables FORWARD chain to your own http server and serve the ACME challenge/response things from there. This is basically a transparent proxy setup.

[ Parent | on HN ]

Re:VPN use is at an all-time high – but are people safe? by rootusrootus on Tuesday July 04, 2023 @01:37PM (#36589962)

What does that buy you? The challenge is merely an authorization, intercepting it does not get you a certificate.

[ Parent | on HN ]

Re:VPN use is at an all-time high – but are people safe? by blueflow on Tuesday July 04, 2023 @02:11PM (#36590491)

What else would i need to request the certificate?

[ Parent | on HN ]

Re:VPN use is at an all-time high – but are people safe? by 3np on Tuesday July 04, 2023 @10:11AM (#36586954)

The ambition is that this will be addressed by supporting RFC8657[0], which would allow domain owners to restrict HTTP-01 issuance by declaring an issuance policy through DNS records. It's been live at staging for years and still waiting to make it to prod[1].

DNS-01 attacks are by default similarly vulnerable to MitM between the issuer and your DNS server, which can be mitigated by setting up DNSSEC.

[0]: https://datatracker.ietf.org/doc/html/rfc8657

[1]: https://community.letsencrypt.org/t/prod-support-for-rfc8657...

[ Parent | on HN ]