Tobi Nary

I would argue that a software certificate or key is „something you know“ and not „something you have“; there‘s a reason, HSMs generate the key themselves to solve this problem. The factor types „something you know/have/are“ are often helpful in identifying wether it‘s multi-factor. A part about that would make the answer better.

This is a social question and not security-related. Hence, I VTC'd

@BramRuttens as you can see, brainstorming didn't work - and is generally not a good fit for a Q/A framework like SE. Most questions for brainstorming might result in a close for "opinion-based" or "too broad". If there is a working concept (like certificate pinning with a supplied trust store), an answer that adheres to the quality standards (at least of my answers) is hard to write and will not help you any further as does pointing you towards the already established concept.

@BramRuttens No problem. The question is still off topic here, tho

(Side note, @BramRuttens: This approach precludes valid MITMs like company-wide TLS-Proxies that break up TLS to scan for malicious content. Those are widely in use in large IT-Infrastructures as part of permimeter security efforts.)

@BramRuttens that is what I would suspect as well. As soon as you can hook into the certificate validation process, you need to supply a store and check the presented cert against your cert and you are good to go (as long as your store is secure and there are no valid reasons for MITM)

@BramRuttens As you seem to be around, can you clarify what your question is, exactly?

@Peter Harmann Also, that is not what OP is suggesting in his question; OP is asking how. And certificate pinning (i.e. checking the validity of the certificates within the application context) does provide that.

@Peter Harmann … which is exactly what certificate pinning does: handling trust of certificates within the application instead of trusting the OS trust store.

@PeterHarmann I am claiming that it is an option. Better/easier in comparison to what else exactly?

@PeterHarmann Again, HPKP is not what I was suggesting. I was suggesting certificate pinning, i.e. fixing certain certificates. Wether this includes one or 1000 certificates is up to OP to implement. Also, being the browser i.e. the end of the end-to-end-encrypted channel, you can insert as you please, even if you would want to (though I don't see a reason to).

@PeterHarmann how would certificate pinning not be the answer? If you're concerned about untrusted CAs, just pin your own CA (or a trusted one) in the networking code and be fine. I agree that HPKP is not the right way to approach this, but that's not what I suggested.

The answer is certificate pinning. But the question is, as Steffen suggested, off topic here.

No problem; have a nice day over at the other part of the world;)

I'll go home from work now;)

(which explains the confusion)

(which in this case only consists of the domain part, and the / path)

the question is about two different sites being served on the same url

The thing with your answer is: it may answer the title, but not the actual question

No problem

TLD is exactly r0k.us

"domain" might mean "what.the.heck.r0k.us" or "never.r0k.us" or "us"

Yes: "domain" is more general than "Top Level Domain"

> Is there a difference here between "domain" and "TLD"?

there might be streets with just one house, but there might be streets with multiple houses (and there might even be multiple tenants living in different parts of those houses)

saying "there's two sites on one domain" is like saying "there's two houses on this street".

so those websites are delivering different content and have different URLs (same domain, different path)

the website doesn't have a domain, it has a URL instead (which has a host-part, which is a domain)

the domain of your example is r0k.us

domain and website are not correlating the way you hope for

yet:

Yeah, that's two websites on the same domain

neither between IP and Host (even your notebook has probably two IPs when connected to a LAN and WiFi)

so there isn't a 1:1 relationship between domain and IP

but the domain name might very well point to a whole range of IPs rather than just one

and a domain of such a service might point to the same IP, served by different hosts (which might have multiple IPs themselves).

exactly

So, as "domain" means "domain name" or rather Fully Qualified Domain Name, it consists of a.b.c.d.e for example. a domain might have several levels of subdomains which are just pointers to IPs (and thus hosts)

No, that's an entity. A network participant is an actual machine sending signals to and receiving them from a network

"Domain" in this context is most often used as a short hand for "domain name" as in "domain name system"

i.e. TLDs are domains. And subdomains (second, third, fourth,…- level domains) are domains still

"Domains" is a super-set of TLDs.

A hosting service is usually abriviated as "hoster". I can see, though, how those extra two bytes may be spared from a webdev point of view, whereas "network participant" is abtracted from.

The terminology of "host" defaulting to "network participant" rather than "hosting service" is probably due to the heavy influence on the ITSec community from networking protocols and specialists.

(as is emulates multiple virtual hosts on a single machine/IP)

actually, that feature is called virtual hosts

Yeah, kinda

(which it is absolutely not; a.b.c.d is a domain; as is c.d)

What struck me was that you did use "domain" synonymous to "TLD"

Yet, Domain, Host, IP and Site are mutually completely different