The Dark Side of Certificate Transparency (sans.edu)

Slashdot reader UnderAttack writes: Certificate Transparency is a system promoted by companies like Google that requires certificate authorities to publish a log of all certificates issued. With certificate transparency, you can search these logs for any of the domains you own, to find unauthorized certificates. However, certificates are not only used for public sites. And with all certificates being published, some include host names that are not meant to be publicly known. An update of the standard is in the works to allow entities to obfuscate the host name, but until then, certificate transparency logs are a good recognizance source.

Comments

recognizance ?!

[Anonymous Coward]

I don't think you know what that word means!

Hostname leaks and internal CA

[plsuh]

1) Hostnames leak all the time. A client will make a DNS request and the name becomes known even if it is not resolvable on the public Internet.

2) If you really care that much, run an internal CA. Lots of ways to do it, most server OS's have built-in or easily available internal CA software.

Keeping a hostname out of the certificate log is pretty much pointless security by obscurity.

Re:Hostname leaks and internal CA

[TheRaven64]

The second point doesn't make a difference. If your clients support certificate transparency, then they will publish any server certs that they come across. It doesn't matter what the cert is. The real point, however, is that if the machine should not be routable from outside of your network, then you should not make it routable from off your network. Assuming that the hostname (or IP) is secret is silly.

Certificate Transparency?

[fustakrakich]

Don't you think that Certificate Security would be the priority?

An update of the standard is in the works to allow entities to obfuscate the host name..

So now the whole idea becomes entirely useless, aside from the public relations.

Certificates are cookies, just another word with more syllables and some different letters.

Perhaps I'm missing something...

[SvnLyrBrto]

... in my pre-coffee state. But:

> vpn.miltonsandfordwines.com
> upstest2.managehr.com
> mail.backup-technology.co.uk

How exactly is the knowledge of the existence of any of these domains a problem? Just about any given domain can be assumed to have a mail.whatever.com subdomain. Internal testing domains are internal and, if they're ever publicly routable at all, are only opened up for the duration of the test and then closed down again. And just the knowledge of a VPN address should never be enough. At the very least you also need a valid username/password. You probably need a 2-factor token. And you possibly need a client certificate of your own to access it.

I'm failing to see any "dark side" here.