Episode #125 of the Stack Overflow podcast is here. We talk Tilde Club and mechanical keyboards. Listen now
82

You have identified only one risk, that of an attacker identifying machine roles on the network by using predictable host names. I think you missed the competing risk, that of increased operator error by not using predictable and descriptive host names. This is how I would assess those conflicting measures: Use unpredictable host names Benefit(s) An ...


19

The fact that there is no readily available information to support your conclusion, should give you some idea about its validity. The point is, that if your attacker is already in, he will need to do some additional foot-printing anyway. Your host name may be database.xyz.intranet, but if the nmap gives you 1521 (oracle), 1433 (sql server) or 5432(Postgress)...


15

What you're advocating for is called "security though obscurity". While in theory obscurity does provide some extra protection while not making things worse, it usually does make things worse in practice. It (1) adds complexity to the system which leads to errors, (2) dilutes the understanding of what information is secret and what isn't, and (3) may have a ...


4

Yes, under certain circumstances, they can. TXT records are frequently used to verify the domain name ownership for various reasons, including (but not limited to) TLS (HTTPS) certificate issuance. For instance, this is how it is done with DigiCert which is one of, if not the, largest certificate authority in the world. Note that the process is just the ...


2

So If I entered the IP address of a website directly I will not be a victim of DNS cache poisoning ?? This depends on the web server its configuration. Often web server use virtual hosts in order to host multiple domains on the same web server. Based on the domain name, the content of the web page is routed to the proper content directory for that specific ...


2

IF the local government or the ISP of the site wants to log your IP address while you visit example.com, they would rather read it from the TLS Client Hello handshake's (plain) Server Name Indication (SNI) extension. Therefore, the DNS is not the first thing to be worried about in this situation, but let's explain why they would not choose the DNS queries ...


2

DNS can be a point of attack, yes. DNS exists because remembering something like 198.51.100.36 is significantly harder to remember than Lamouette.com. If you want to give it a go, more power to ya but I'd caution that if it's a public web presence you're after, your visitors will not appreciate having to use your IP address over your domain name. And if ...


2

There are and you mentioned one: favourites. Favourite or bookmarks do exactly what you want. But I suppose that you feel that there is a problem with that as a solution, and there is. The problem has to do with the balance of security and convenience. You want something that is effective but does not reduce your ability to do what you want. A solution has ...


Only top voted, non community-wiki answers of a minimum length are eligible