Hacker News Reader

I was wondering recently if it's better to use wildcard certs because of this. On the other hand, all sub-domains are discoverable through DNS anyways. Does it then make a difference if the sub-domains are logged in the certificate transparency logs?

View on HN

How do you figure all subdomains are discoverable through DNS? The zone transfer record or whatever it is is usually disabled. And you can't bruteforce all subdomains - they might be too long/unpredictable.

I was mistaken about this apparently. There are tools though, that can discover subdomains using long lists of commonly used names and patterns. Anyways thanks for the correction.

Public DNS servers use rate-limiting in various ways. It should not be possible to do a large brute force attempt.

Reply on news.ycombinator.com