[dead]
Ask HN: How did the internet discover my subdomain?
311–320 of 322 posts
Re: Ask HN: How did the internet discover my subdomain?
#312DNS Leaks or Public Records
DNS Propagation:
When you create a subdomain (e.g., blog.yoursite.com), your DNS provider (e.g., Cloudflare, GoDaddy) updates global DNS servers. These records are public and visible to anyone who queries the DNS (e.g., via dig blog.yoursite.com).
WHOIS Data:
If your domain registration details are public (not privacy-protected), your subdomain’s ownership info may be exposed.
Re: Ask HN: How did the internet discover my subdomain?
#313Hi, our company does this basically "as-a-service". The options how to find it are basically limitless. Best source is probably Certificate Transparency project as others suggested. But it does not end there, some other things that we do are things like internet crawl, domain bruteforcing on wildcard dns, dangling vhosts identification, default certs on servers (connect to IP on 443 and get default cert) and many oth…
Hi, former pentester here. If any one of your trusted clients is using a google/chromium based browser, the telemetry from that browser (webdiscovery) would reveal the existence of the subdomain in question. As others have said, security by obscurity doesn't work.
[flagged]
Re: Ask HN: How did the internet discover my subdomain?
#314Hi, our company does this basically "as-a-service". The options how to find it are basically limitless. Best source is probably Certificate Transparency project as others suggested. But it does not end there, some other things that we do are things like internet crawl, domain bruteforcing on wildcard dns, dangling vhosts identification, default certs on servers (connect to IP on 443 and get default cert) and many oth…
Joke's on you, I don't have ports 80 or 443 open on my subdomains.
Re: Ask HN: How did the internet discover my subdomain?
#315One way is query your ip, retrieve certificates, read the domain(s) in it.
I made my server return self signed certificate without domain name in it, in case of access to wevserver's port 433 by ip instead of by domain name.
Re: Ask HN: How did the internet discover my subdomain?
#316Some CAs (Amazon) allow not publishing to the Certificate Transparency Log. But if you do this, browsers will block the connection by default. Chromium browsers have a policy option to skip this check for selected URLs. See: CertificateTransparencyEnforcementDisabledForURLs. Some may find this more desirable than wildcard certificates and their drawbacks.
To avoid subdomain discovery, I usually acquire certificate domain level and add a wildcard SAN.
Will you send me an invite to tildes?
Re: Ask HN: How did the internet discover my subdomain?
#317Earlier quoted context omitted.
Serious question: Do you really think that Cloudflare is trying to keep these kinds of thing private? If so, I'd suggest that's not a reasonable expectation.
Related question (not rhetorical). If you do DNS for subdomains yourself (and just use Cloudflare to point dns.example.com at your box) will the subdomain queries leak and show up in aggregate datasets? What I'm asking is if query recursion is always handled locally or if any of the reasonably common software stacks resolve it remotely.
If you just use Cloudflare as a registrar, then they can't see what resolution happens on your servers.
If you delegate a subdomain through Cloudflare to your own DNS servers, from what I remember from the animal book, the recursive server should ask Cloudflare for the address of the machine to which the delegation has been made (yours), and while any further resolutions would be answered by your machine, Cloudflare would at very least know of every query to that subdomain.
If you delegate a subdomain and have subdomains under that subdomain, then Cloudflare would only see resolutions to that subdomain and not to the sub-subdomains.
In other words, for most things, they'd have full insight.
Re: Ask HN: How did the internet discover my subdomain?
#318Earlier quoted context omitted.
"Security by obscurity does not work" This is one of those false voyeur OS internet tennets designed to get people to publish their stuff. Obscurity is a fine strategy, if you don't post your source that's good. If you post your source, that's a risk. The fact that you can't rely on that security measure is just a basic security tennet that applies to everything: don't rely on a single security measure, use redundant…
> "Security by obscurity does not work" The saying is "security by obscurity is not security" which is absolutely true. If your security relies on the attacker not finding it or not knowing how it works, it's not actually secure. Obscurity has its own value of course, I strongly recommend running any service that's likely to be scanned for regularly on non-standard ports wherever practical simply to reduce the number…
> If your security relies on the attacker not finding it or not knowing how it works, it's not actually secure.
Every branch of the military would like to talk to you and inform you that sometimes, the enemy not finding the target, or not knowing how the target works, can be extremely, actually secure. Like, still alive secure. I'd argue that's a rather effective security measure in certain situations.
Then there's compartmentalization, need to know, and then all of the security clearance levels...
Leaking classified documents can be considered treason, which is one of very few non-violent crimes you can commit that could result in the death penalty.
The Fed seems to think security through obscurity is a pretty fucking alright thing, seeing as how they use it everywhere.
Re: Ask HN: How did the internet discover my subdomain?
#319Hi, our company does this basically "as-a-service". The options how to find it are basically limitless. Best source is probably Certificate Transparency project as others suggested. But it does not end there, some other things that we do are things like internet crawl, domain bruteforcing on wildcard dns, dangling vhosts identification, default certs on servers (connect to IP on 443 and get default cert) and many oth…
[dead]
Re: Ask HN: How did the internet discover my subdomain?
#320Earlier quoted context omitted.
No, it's not the only thing, but it is one layer of defense in depth. No one is saying that obfuscation should be the only layer. Your defense should never hinge on any single protection layer.
So we're all agreeing here. It's ok to hide stuff from sight, but hiding stuff from sight isn't actually security and can't replace at the very least, having password protection.
But it is security. It's one layer of it.