4 ms·

>HSTS wouldn't help users clicking through warning Actually it would have! Chrome and possible other browsers do not allow clicking throw certificate validatio

• cft 8y ago
  Sorry how does that help if the attackers purchase a new "valid" SSL certificate since they control the DNS and thus email?
  • f2n 8y ago
    It does not help for that scenario, but it forces the attackers to jump through another hoop, and publish that a new cert was issued for the domain.
  • rocqua 8y ago
    Once you control DNS, it doesn't require email, you can just use lets-encrypt. The lets-encrypt verification does not check HSTS. Makes sense because it keeps HSTS from the lockout scenario that makes HPKP so scary.
    • cft 8y ago
      Is it possible to get a TLD registrar to set a very short TTL like 5min on your NS record? Then you can switch to a backup DNS hosted on another network fast.
      • rocqua 8y ago
        Yes, you can set a short TTL on your NS record, but that would not keep this attack from hijacking your site. This attack intercepts the clients DNS lookup, so the DNS a browser is talking to is ill-behaved. No amount of correct setup here will work because the ill-behaved DNS server will just replace your setup with whatever that server wants. There is no strong defense against this as a website. With an app the solution would be certificate pinning. You could try HPKP but that comes with a host of issues and I think it is being deprecated.
        • cft 8y ago
          Wait: in example.com say .com registrar sets a 5min TTL on NS record for example.com that resolves to 1.2.3.4. That means that your DNS server is at 1.2.3.4, serving your A and MX records. An attacker BGP hijacks 1.2.3.4. You change NS record in your .com registrar settings to 5.6.7.8 that is not compromised. Notice I am not talking about your A or MX records that you controlled on a compromised IP, but of NS record that a .com registrar controls. So after 5 min the browsers contact a non-compromised nameserver at 5.6.7.8 to get your A records. I think unless a TLD registrar gets hijacked that mitigates the attack on your own DNS after the NS TTL
          • deleted 8y ago
            [deleted]
          • rocqua 8y ago
            You are right, I was thinking of a different attack. Something like a BGP-hijack of 8.8.8.8 , 1.1.1.1 or similar often used DNS resolvers. Here though, people using area53 for DNS probably can't move away from it as they are stuck on amazon.