Hacker News Reader

Comment by feelin_googley | Hacker News Reader

"be a localhost .de"

Why cant they just use a HOSTS file entry? What is the need for DNS?

If there is no need for DNS then why use the public, commercial CA system? That system relies on domainname registration credentials as "authentication".

Not sure I understand the design of this software. What is the purpose of the web server?

View on HN

the whole thing is basically a webmail service, but the client provides crypto-functions to encrypt and decrypt messages locally using a smart card reader. The client software has an API which is provided as a webservice on localhost:9998 (FQDN: bealocalhost.de). At first they ran this service with a certificate that was signed by a trusted CA. I reported them for disclosing the private key of that cert. Communication between the client (java-application) and the webmail service (website) is done via javascript in the browser, which connects to services on localhost using websockets.

The whole thing is probably written as a web app, that's why they need a web server. It probably uses React and runs on node.js... "we need HTTPS, the easiest thing to do is be a root certificate", thought the JavaScript Full-Stack developer...

No, "besonderes elektronisches Anwaltspostfach localhost .de".

The web server is because it's a locally hosted web app. The DNS name is so a certificate authority will issue them a certificate.

Reply on news.ycombinator.com