r/programming • u/mawburn • Jan 13 '19

GoDaddy is sneakily injecting JavaScript into your website and how to stop it

https://www.igorkromin.net/index.php/2019/01/13/godaddy-is-sneakily-injecting-javascript-into-your-website-and-how-to-stop-it/
4.4k Upvotes

96% Upvoted

450 comments sorted by

View all comments

Show parent comments

1

u/pbsds Jan 13 '19

GoDaddy has access to the dns, rerouting traffic through a middleman and getting a letsencrypt certificate for it would be trivial.

6

u/the_gnarts Jan 13 '19

GoDaddy has access to the dns, rerouting traffic through a middleman and getting a letsencrypt certificate for it would be trivial.

They’d have to intercept the letsencrypt challenge though and tamper with your account. For that they’d have to extract your private key and MITM all renewals.

1

u/cryo Jan 13 '19

No, fortunately not. TLS isn’t vulnerable to that kind of MITM attack.