Hacker News Reader

Comment by eatonphil | Hacker News Reader

Another interesting way subdomains leak is through TLS cert registration. I.e. you can plug a domain into this search [0] and find subdomains that have public TLS certs.

I just noticed a full blog post on this topic is also on the front of HN right now. [1]

[0] https://transparencyreport.google.com/https/certificates?hl=...

[1] https://shkspr.mobi/blog/2022/01/should-you-use-lets-encrypt...

View on HN

Tangentially related: I’ve wondered what would happen if you purchased a domain name that had previously been owned by someone else and they had obtained a TLS certificate from a CA with an expiration date beyond when your ownership began. This seems like a good tool to find such a certificate, but if you found one what would you do? Would the holder of the certificate be able to MITM or otherwise impersonate you? Would there be a way to revoke the certificate (I’m guessing you could contact the CA that issued it?)? Do CAs automatically revoke certificates when domain ownership changes?

How would you retrieve the private key for that certificate?

You wouldn’t. But the CA that issued the certificate could still revoke it, correct? E.g. https://letsencrypt.org/docs/revoking/#using-a-different-aut...

Yes, from that same link you can see that whoever controls the domain can revoke those certificates (by asking Let's Encrypt to revoke it). All you need is the certificate itself (which you can get from the transparency logs e.g. crt.sh), not the private key.

It's unclear. Do you know what CA's you currently trust on your machine? I bet you can't even identify 1 tenth of them.

There are so many CA's installed by default that it's truly a massive man-in-the-middle attack whenever you might think you are safe, you are not.

I would assume the CCP & the KGB control at least one of the CA's your OS currently trusts. (No doubt the NSA has one too)

In debian: dpkg -L ca-certificates

There's been some research on this! https://insecure.design/

That’s awesome, thank you for the link!

Oh … wow.

How is LetsEncrypt going to handle revocation … in under 24 hours?

Reply on news.ycombinator.com