All Questions
84
questions
0
votes
1
answer
145
views
How can I test in my device checks DNS CAA correctly and rejects TLS certificates that are signed by an unauthorized CA?
I would like to know how I can test if my devices, or browsers1 checks and applies DNS Certification Authority Authorization (CAA) correctly. And if it does not, how I can enable it and enforce CAA to ...
- 6,715
1
vote
1
answer
152
views
Is it reasonable to have a product that requires LLMNR or mDNS?
I am trying to figure out the best way to manage security certificates for embedded devices who's webpage is accessed via IP address, and then the scenario for when that IP address changes.
Currently, ...
0
votes
2
answers
123
views
Would a signed TLS certificate prevent an attacker from stealing a domain?
I'm trying to understand how the attack described in this article could work. Let's grant that this attacker, not associated with company.com, managed to take control of oldsub.company.com. Here's a ...
- 101
1
vote
1
answer
1k
views
How to check to see whether DNS over TLS is blocked in my network by ISP?
I'm looking for a method to check whether DNS over TLS is blocked in my network by my ISP or not. A method that isn't just trial and error of a bunch of popular DoT providers to see which one connects ...
user279925
6
votes
2
answers
2k
views
Can DDNS provider perform a MITM attack? [duplicate]
I'm using duckdns as my free ddns provider. The domain is in the form domain.duckdns.org.
I believe it would be technically possible for them to copy the files my server hosts, redirect "my" ...
- 163
1
vote
1
answer
718
views
SNI leakage prevention with proxy
In TLS 1.2 / HTTP(S) context, plaintext target hostname could potentially leak in 3 different ways:
In DNS query prior to TCP/TLS/HTTP connection.
In TLS handshake, ClientHello message, in SNI ...
user237016
7
votes
1
answer
941
views
Verifying that no malicious certificate has been issued while a DNS record was pointing to an uncontrolled IP
Given the scenario that:
Victim rents VM1 from a cloud provider, and points his/her DNS record to that VM1's IP address
Victim deletes VM1 and switches to a different cloud provider, and creates VM2 ...
- 93
1
vote
2
answers
417
views
Relationship between DoT / DoH and HTTPS
I'm trying to understand the different roles that DoT / DoH and HTTPS are playing when it comes to protecting sensitive data in the internet. I spend the day reading a lot of stuff about DoT, HTTPS, ...
- 135
3
votes
1
answer
1k
views
What is the purpose of the critical flag being enabled (128) on a CAA IODEF record?
CAA, or Certificate Authority Authorization, provides a way to designate which CAs are allowed to create a Certificate for specific domains. This is done accomplished by publishing new caa DNS records,...
- 781
1
vote
1
answer
893
views
DNS spoofing over https [duplicate]
If a device sends a request to https://example.com and someone spoofs the DNS response to redirect the request to some malicious server. Would the attacker be able to modify the packets during the TLS ...
- 13
0
votes
1
answer
246
views
Should I redirect http request to https from my system's application or from DNS or other? [closed]
I want to create a web server that does redirects HTTP to HTTPS. What is the simplest method to do this but also secure? Should the DNS handle this? (For example, Route53)
I used to do this with my ...
- 101
0
votes
0
answers
210
views
Why is there no DNS mechanism for requiring HTTPS on a domain?
Typically, HTTPS redirection happens like this:
The user clicks or types an HTTP link, e.g. http://example.com/url.
If the browser has seen a Permanent (301) redirect to HTTPS for that exact URL, it ...
- 134
26
votes
5
answers
12k
views
Why is DNS-over-HTTPS such a big security nightmare compared to DNS-over-TLS?
I've heard the argument against DNS-over-HTTPS that it is supposed to be a security nightmare for network defenders because it enables encrypted DNS over port 443, compared to DNS-over-TLS which goes ...
- 479
5
votes
1
answer
3k
views
Is there a security vulnerability in setting a public DNS entry to a private IP Address?
I recently set up a wireguard server-network configuration with a home server and client devices. I have one main domain that I hope to route everything through via subdomains (in this example, abc....
- 153
1
vote
0
answers
425
views
Why are DNS prefetch requests sent in clear text with DNS over HTTPS enabled?
I am trying to understand how DNS-over-HTTPS (DoH) works in both Chrome and Firefox browsers.
To do so, I have enabled DoH on each browser and set the DNS provider to Cloudflare DNS servers (1.1.1.1 ...
- 11