Hacker News Reader

Comment by poincaredisk | Hacker News Reader

Historically, before wildcard certificates were suddenly available for free, this leaked all internal domains to the internet, but now it's mostly a solved problem.

View on HN

I don't understand why that is such a huge problem. The alternatives have much more severe problems, all from reusing a wildcard in many places to running your own PKI.

It depends on your risk profile, but there are definitely people who'd rather run their own PKI than permit threat actor reconnaissance by publishing internal hostnames to CT logs.

When this information is useful you've either got fundamental security related issues that needs to be addressed long before this, or you're dealing with threat actors with significant capabilities. In the latter case you've probably already taking this into account when you're creating your stuff, or you have the capability and technical understanding to know how to properly roll out your own PKI.

The overlap of people that suggest that you either run your own PKI or just distribute a wildcard certificate and have the technical understanding on how to do this in a secure way is minuscule. The rest of those people are probably better off using something like Lets Encrypt.

I still think it's a good idea not to expose more information than necessary, mostly for the reasons we can't think of.

Also I wouldn't be surprised if Let's Encrypt/ZeroSSL were compromised.

It would surprise me if it was, because of features like certificate transparency logs.

> suddenly available for free

I have to wonder if there is some hidden ulterior motive behind that.

Let's Encrypt is a well funded non-profit project. What ulterior motive do you imagine?

https://letsencrypt.org/sponsors/

I think the obvious is a world government that wants to spy on everyone.

So what? Do you keep secrets in your domain names?

Reply on news.ycombinator.com