Security through obscurity is underrated (2020)
This is something that really needs to be said more in amateur circles (i.e. self-hosters and homelabbers). For these scenarios I think it&#x27;s even worse, though, because it&#x27;s a case of insecurity through transparency. People don&#x27;t realize that all ACME&#x2F;Let&#x27;s Encrypt certificates are published in transparency logs that get scanned constantly, giving attackers a shiny target. I saw a reddit post recently (which I won&#x27;t link for the victims&#x27; sakes) where someone had searched for Heimdall (a popular dashboard) in a web-security-oriented search engine and found a bunch of insecure publicly facing instances, some of which contained credentials.<p>Fixing this would be as simple as using wildcard certs, wildcard dns, and unique subdomains. Configure your web server to 404 any request without a valid subdomain (esp. www.domain.tld or domain.tld) and you&#x27;ve avoided nearly every web-based scan because the attacker doesn&#x27;t know the host name. This is pure obscurity, but it definitely works.<p>Yes, host name can get leaked through SNI, but if someone is monitoring your traffic, you probably need something more sophisticated anyways.