4 ms·

How would you go about verifying the domain from who controls the "IP space"? A cloud provider/datacenter controls the IP space in the majority of cases. If s

How would you go about verifying the domain from who controls the "IP space"? A cloud provider/datacenter controls the IP space in the majority of cases. If someone owns your DNS, they can use almost any CA to get valid certs for your domain (apart from EV only ones). That's kind of how Domain Certs work. "A domain-validated certificate (DV) is an X.509 digital certificate typically used for Transport Layer Security (TLS) where the identity of the applicant has been validated by proving some control over a DNS domain" If this is something that worries you, then you should only trust sites that have Extended Validation certificates.

peterwwillis 9y ago
> If this is something that worries you, then you should only trust sites that have Extended Validation certificates. Every user of the web in the world would have to do this in order to avoid this vulnerability.
- snowwolf 9y ago
  Exactly. Domain verified certificates guarantee one thing and one thing only. The data transmitted is encrypted and cannot be tampered with. That's it. They do not guarantee you are communicating with who you think you are. But to be honest if your DNS service is compromised, you have bigger problems.
  - peterwwillis 9y ago
    The thing is... it shouldn't be this way. The whole point of TLS is to provide privacy, integrity, and authority. Having a secured connection is pointless if it's a connection to an attacker. Oh, great, nobody can spy on my connection to the NSA. All DNS is supposed to do is to point you at the server to get your connection from. It isn't supposed to mediate the security of the connection. This is back to the old chicken-and-egg of public key crypto: public key connections are secure, as long as you provide the initial host key in a secure, out-of-bound method. If an attacker can circumvent this and inject their own initial host key, they can MITM. Hence why PKI exists: to prevent an outside service from defeating the security of the connection. But apparently, DNS can compromise the connection, by allowing attackers to just generate certs willy-nilly if they can guess your GoDaddy account password.

peterwwillis 9y ago

> If this is something that worries you, then you should only trust sites that have Extended Validation certificates. Every user of the web in the world would have to do this in order to avoid this vulnerability.

snowwolf 9y ago
Exactly. Domain verified certificates guarantee one thing and one thing only. The data transmitted is encrypted and cannot be tampered with. That's it. They do not guarantee you are communicating with who you think you are. But to be honest if your DNS service is compromised, you have bigger problems.
- peterwwillis 9y ago
  The thing is... it shouldn't be this way. The whole point of TLS is to provide privacy, integrity, and authority. Having a secured connection is pointless if it's a connection to an attacker. Oh, great, nobody can spy on my connection to the NSA. All DNS is supposed to do is to point you at the server to get your connection from. It isn't supposed to mediate the security of the connection. This is back to the old chicken-and-egg of public key crypto: public key connections are secure, as long as you provide the initial host key in a secure, out-of-bound method. If an attacker can circumvent this and inject their own initial host key, they can MITM. Hence why PKI exists: to prevent an outside service from defeating the security of the connection. But apparently, DNS can compromise the connection, by allowing attackers to just generate certs willy-nilly if they can guess your GoDaddy account password.