<story><title>Cisco subdomain private key found in embedded executable</title><url>https://groups.google.com/forum/#!topic/mozilla.dev.security.policy/T6emeoE-lCU</url></story><parent_chain></parent_chain><comment><author>pilif</author><text>The domain in question (drmlocal.cisco.com) resolves to 127.0.0.1. This is a handy and above all cross-platform&amp;#x2F;cross browser way for a website to talk to a locally installed application (that&amp;#x27;s running a web server, bound to the loopback interface) by using CORS and&amp;#x2F;or jsonp.&lt;p&gt;If the site that wants to make use of this is using SSL, then the locally running web browser also needs to be using SSL and it needs to have a publicly trusted cert.&lt;p&gt;The other alternative (installing a local CA) seems to be worse.&lt;p&gt;An option would be for the locally installed app to ask a server for a cert to use while it&amp;#x27;s running, but that means that the app needs to phone home which it otherwise would not have to.&lt;p&gt;So I guess we&amp;#x27;re back to proprietary browser extensions if this technique is frowned upon.</text></comment>
<story><title>Cisco subdomain private key found in embedded executable</title><url>https://groups.google.com/forum/#!topic/mozilla.dev.security.policy/T6emeoE-lCU</url></story><parent_chain></parent_chain><comment><author>throwawaysec0xf</author><text>For whatever it&amp;#x27;s worth, the team behind this stupidity has been let go a while back...&lt;p&gt;Throwaway account for obvious reasons.</text></comment>