3 ms·
As I understand the attacks being against the login admin accounts for managing the domain itself, no DNSSEC would not have prevented changing the records in th
by bluejekyll 8y ago
As I understand the attacks being against the login admin accounts for managing the domain itself, no DNSSEC would not have prevented changing the records in the zone. In addition, if the DNS provider hosting that domain automatically resigned the zone for the hacked account, then the hosting company would even have resigned the zone, thus making valid DNSSEC entries anyway.
What would be better is to require 2FA for all zone hosting companies.
- regecks 8y ago> What would be better is to require 2FA for all zone hosting companies. Even with this, many registrars and DNS hosts are too fast and loose with disabling 2FA when you call them up and tell them you lost your second factor. Alternatively, requesting changes over the phone without going through web authentication. My confidence in 2FA dipped quite a bit after going through the experience myself.