Ask HN: How did the internet discover my subdomain?

Post by ehutch79 » Fri, Mar 07, 2025, 4:43 PM UTC

HeatrayEnjoyer wrote: post #230

yapyap wrote: post #175

Earlier quoted context omitted.

> This is one of those false voyeur OS internet tennets designed to get people to publish their stuff. No it isn’t, it’s a push to get people to login protect whatever they want to keep to themselves. It’s silly to say informing people that security through obscurity is a weak concept is trying to convince them to publish their stuff.

If security through obscurity didn't provide any benefit then governments wouldn't have built entire frameworks for protecting classified information.

Post by unethical_ban » Fri, Mar 07, 2025, 4:53 PM UTC

TZubiri wrote: post #143

yatralalala wrote: post #139

Hi, our company does this basically "as-a-service". The options how to find it are basically limitless. Best source is probably Certificate Transparency project as others suggested. But it does not end there, some other things that we do are things like internet crawl, domain bruteforcing on wildcard dns, dangling vhosts identification, default certs on servers (connect to IP on 443 and get default cert) and many oth…

"Security by obscurity does not work" This is one of those false voyeur OS internet tennets designed to get people to publish their stuff. Obscurity is a fine strategy, if you don't post your source that's good. If you post your source, that's a risk. The fact that you can't rely on that security measure is just a basic security tennet that applies to everything: don't rely on a single security measure, use redundant…

Post by batch12 » Fri, Mar 07, 2025, 4:57 PM UTC

TZubiri wrote: post #143

yatralalala wrote: post #139

Hi, our company does this basically "as-a-service". The options how to find it are basically limitless. Best source is probably Certificate Transparency project as others suggested. But it does not end there, some other things that we do are things like internet crawl, domain bruteforcing on wildcard dns, dangling vhosts identification, default certs on servers (connect to IP on 443 and get default cert) and many oth…

"Security by obscurity does not work" This is one of those false voyeur OS internet tennets designed to get people to publish their stuff. Obscurity is a fine strategy, if you don't post your source that's good. If you post your source, that's a risk. The fact that you can't rely on that security measure is just a basic security tennet that applies to everything: don't rely on a single security measure, use redundant…

Post by groestl » Fri, Mar 07, 2025, 5:03 PM UTC

govideo wrote: post #87

Thanks for everyone's perspectives. Very educational and admittedly lots outside the boundaries of my current knowledge. I have thus far relied on CloudFlare's automatic https and simple instant subdomain setup for their worker microservice I'm using. There are evidently technical/footprint implications of that convenience. Fortunately, I'm not really concerned with the subdomain being publicly known; was more curiou…

Post by paxys » Fri, Mar 07, 2025, 5:23 PM UTC

p0w3n3d wrote: post #91

paxys wrote: post #62

Not sure why everyone is going on about certificate transparency logs when the answer is right there in the user agent. The company is scanning the ipv4 space and came upon your IP and port.

Finding IP does not mean finding the domain. When doing HTTP request to IP you specify the domain you want to connect to. For example you can configure your /etc/hosts to have xxxnakedhamsters.google.com pointing to 8.8.8.8 and make the http request, which will cause Google getting the domain request (i.e. header Host: xxxnakedhamsters.google.com) and it will refuse it or try to redirect to http. Of course it's only…