Hacker News Reader

It's already been done: https://git.daplie.com/Daplie/localhost.daplie.me-certificat...

Which I find to be a very practical solution for connecting to localhost over https, it frees you from having to install a self-signed certificates/CAs on your machine.

Not a great idea to publish private keys for valid certificates. Anyone could probably submit a certificate revocation request to the CA, as the key would be considered compromised.

Publishing private keys is a violation of the Let's Encrypt terms of service. We are revoking these certificates.

https://letsencrypt.org/documents/LE-SA-v1.1.1-August-1-2016...

Why?

Just a guess: CORS-related attacks

How would that work?

I guess anyone on 127.0.0.1 can pretend to that address. Very unlikely to matter.

Same-site scripting:

http://seclists.org/bugtraq/2008/Jan/270

Interesting. Still, that requires the attacker to be already running a process on the victim's machine, even if with reduced privileges. Nowadays that's rare, since there's no reason not to give each user its own network namespace, at the very least.

Lots of sites seem to be doing it now. Off the top of my head I know that Box and Spotify both do it.