3 ms·

> They can intercept traffic --- including DV cert checks --- without touching nameservers. Huh? I'm talking about certificate issuance and domain ownership he

> They can intercept traffic --- including DV cert checks --- without touching nameservers. Huh? I'm talking about certificate issuance and domain ownership here. If a CA can't verify the domain with the registrar then they fail to issue a certificate, it's as simple as that. It's not like they can get a forged response over HTTPS...

tptacek 9y ago
An attacker who controls arbitrary IP addresses can get a DV cert issued without control of the DNS.
- mehrdadn 9y ago
  > An attacker who controls arbitrary IP addresses can get a DV cert issued without control of the DNS. What? How? Did you read my comment at all? I was saying the CA needs to have a way to verify ownership with the domain registrar. Over HTTPS, obviously. An attacker can't forget a response, so the worst case is the cert doesn't get issued, which it very much shouldn't be if ownership cannot be verified.
  - tptacek 9y ago
    I can't tell whether you're talking about how you think things should work or making claims about how they actually do work. If the latter: no. DV certificate checks don't use HTTPS to validate ownership. The point of DV certificate checks is to provision HTTPS in the first place. If you control BGP, you can thwart DV checks and get a certificate issued. You can do that without touching the DNS at all.
    - mehrdadn 9y ago
      > I can't tell whether you're talking about how you think things should work or making claims about how they actually do work. How can you not tell? I was extremely explicit that this was the former in the very first sentence of my initial comment: >>>>>> Taking a step back here... ___shouldn't___ proving ownership of a domain involve the domain registrar some way, rather than involving whoever happens to host your DNS?
      - tptacek 9y ago
        The only reason we have DV certs is because people find normal certs painful to apply for. They're a convenience. Similarly: LetsEncrypt does HTTP challenges, relying on the DNS as a side effect, because lots of people who need certificates do not control their DNS records, even if they "own" the domain.
        mehrdadn 9y ago
        > The only reason we have DV certs is because people find normal certs painful to apply for. They're a convenience. Similarly: LetsEncrypt does HTTP challenges, relying on the DNS as a side effect, because lots of people who need certificates do not control their DNS records, even if they "own" the domain. You don't seem to be reading a single sentence of what I write at all? My method literally caters to those people who do not control their DNS records because it very explicitly avoids using DNS to verify "ownership". I'm getting tired of this.

tptacek 9y ago

An attacker who controls arbitrary IP addresses can get a DV cert issued without control of the DNS.

mehrdadn 9y ago
> An attacker who controls arbitrary IP addresses can get a DV cert issued without control of the DNS. What? How? Did you read my comment at all? I was saying the CA needs to have a way to verify ownership with the domain registrar. Over HTTPS, obviously. An attacker can't forget a response, so the worst case is the cert doesn't get issued, which it very much shouldn't be if ownership cannot be verified.
- tptacek 9y ago
  I can't tell whether you're talking about how you think things should work or making claims about how they actually do work. If the latter: no. DV certificate checks don't use HTTPS to validate ownership. The point of DV certificate checks is to provision HTTPS in the first place. If you control BGP, you can thwart DV checks and get a certificate issued. You can do that without touching the DNS at all.
  - mehrdadn 9y ago
    > I can't tell whether you're talking about how you think things should work or making claims about how they actually do work. How can you not tell? I was extremely explicit that this was the former in the very first sentence of my initial comment: >>>>>> Taking a step back here... ___shouldn't___ proving ownership of a domain involve the domain registrar some way, rather than involving whoever happens to host your DNS?
    - tptacek 9y ago
      The only reason we have DV certs is because people find normal certs painful to apply for. They're a convenience. Similarly: LetsEncrypt does HTTP challenges, relying on the DNS as a side effect, because lots of people who need certificates do not control their DNS records, even if they "own" the domain.
      - mehrdadn 9y ago
        > The only reason we have DV certs is because people find normal certs painful to apply for. They're a convenience. Similarly: LetsEncrypt does HTTP challenges, relying on the DNS as a side effect, because lots of people who need certificates do not control their DNS records, even if they "own" the domain. You don't seem to be reading a single sentence of what I write at all? My method literally caters to those people who do not control their DNS records because it very explicitly avoids using DNS to verify "ownership". I'm getting tired of this.