119
Hetzner server hosting potentially running MITM proxies on hosted servers (old.reddit.com)
submitted 3 years ago* (last edited 3 years ago) by empireOfLove@lemmy.one to c/selfhosted@lemmy.world
9 comments fedilink hide all child comments

cross-posted from: https://lemmy.one/post/5660007

Likely under the command of law enforcement and without informing any clients.

all 10 comments
sorted by: hot top new old
[-] rho50 37 points 3 years ago

This is why self hosted to me means actually running it on my own hardware in a location I have at least some control of physical access.

That said, an ISP could perform the same attack on a server hosted in your home using the HTTP-01 ACME challenge, so really no one is safe.

HSTS+certificate pinning, and monitoring new certificates issued for your domains using Certificate Transparency (crt.sh can be used to view these logs) is probably the only way to catch this kind of thing.

[-] fmstrat@lemmy.nowsci.com 12 points 3 years ago

Good suggestions at the bottom.

There are several indications which could be used to discover the attack from day 1:

All issued SSL/TLS certificates are subject to certificate transparency. It is worth configuring certificate transparency monitoring, such as Cert Spotter (source on github), which will notify you by email of new certificates issued for your domain names

Limit validation methods and set exact account identifier which could issue new certificates with Certification Authority Authorization (CAA) Record Extensions for Account URI and Automatic Certificate Management Environment (ACME) Method Binding (RFC 8657) to prevent certificate issue for your domain using other certificate authorities, ACME accounts or validation methods

[-] pootriarch@poptalk.scrubbles.tech 1 points 3 years ago

so per wikipedia and confirmed at MDN, firefox is the only major browser line not to consider certificate transparency at all. and yet it's the only one that has given me occasional maddening SSL errors that have blocked site access (not always little sites, it's happened with amazon).

i don't understand how firefox can be simultaneously the least picky about certificates and the most likely to spuriously decide they're invalid.

[-] ericjmorey@programming.dev 10 points 3 years ago

More discussion https://news.ycombinator.com/item?id=37955264

[-] fmstrat@lemmy.nowsci.com 7 points 3 years ago

Post title is missing Linode.

[-] Turun@feddit.de 6 points 3 years ago

Yes. All hosting providers will comply with requests from law enforcement.

Signal and proton mail were forced to hand out information as well in the past. All you can do is choose which provider you distrust the least.

[-] Decronym@lemmy.decronym.xyz 2 points 3 years ago* (last edited 3 years ago)

Acronyms, initialisms, abbreviations, contractions, and other phrases which expand to something larger, that I've seen in this thread:

Fewer Letters More Letters
HTTP Hypertext Transfer Protocol, the Web
SSL Secure Sockets Layer, for transparent encryption
TLS Transport Layer Security, supersedes SSL

[Thread #232 for this sub, first seen 22nd Oct 2023, 23:05] [FAQ] [Full list] [Contact] [Source code]

[-] possiblylinux127@lemmy.zip 1 points 3 years ago

My domain has two certs issued to it. Am I in trouble?

[-] TheHolm@aussie.zone 1 points 3 years ago

Is it tame for selfhosted to switch to DANE?

this post was submitted on 20 Oct 2023
119 points (96.9% liked)

Selfhosted

62903 readers
356 users here now

A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.

Rules:

Detailed Rules Post

  1. Be civil.

  2. No spam.

  3. Posts are to be related to self-hosting.

  4. Don't duplicate the full text of your blog or readme if you're providing a link.

  5. Submission headline should match the article title.

  6. No trolling.

  7. Promotion posts require active participation, with an account that is at least 30 days old. F/LOSS without a paywall has exceptions, with requirements. See the rules link for details. Tags [CBH] or [AIP] are required, see the links in Rule 8 for details.

  8. AI-related discussions and AI-involved promotional posts have additional requirements for tagging, as noted in Rule 7 and the AI & Promotional Post Expanded Rules post, and find example disclosures here.

Resources:

Any issues on the community? Report it using the report flag.

Questions? DM the mods!

founded 3 years ago
MODERATORS
ruud@lemmy.world
Loki@lemmy.world
CannaVet@lemmy.world
devve@lemmy.world
ayyy@sh.itjust.works
curbstickle@anarchist.nexus
curbstickle_lw@lemmy.world