4 ms·
I'm pretty intrigued by the cryptocurrency-based DNS alternatives that get kicked around in discussions like this. But if you need a way to mitigate this threat
by Meekro 6y ago
I'm pretty intrigued by the cryptocurrency-based DNS alternatives that get kicked around in discussions like this. But if you need a way to mitigate this threat for your business today, I'd recommend Cloudflare's Enterprise Registrar.
It was designed specifically to prevent these kinds of attacks. You can design your own security procedure. "For instance, if a Custom Domain Protection client wants us to not change their DNS records unless 6 different individuals call us, in order, from a set of predefined phone numbers, each reading multiple unique pass codes, and telling us their favorite ice cream flavor, on a Tuesday that is also a full moon, we will enforce that. Literally."
As far as I can tell, they've never been pwned.
- deleted 6y ago[deleted]
- viraptor 6y agoBut this is only a procedure for the customer. We'd hope that their employees have internal rules that are just as strict for interacting with internal IT, but can't be sure. The rules for the customer don't matter much is it get hold of a company account which can make the right change. Re. Cryptocurrency, I'd be really nervous implementing that in production. The current registers may not be perfect, but there's an escape hatch where things go wrong, you contact the right people and changes get reverted. With coin based DNS, the right hack may mean you lose access to your domain forever and there's no rollback possible.
- CydeWeys 6y agoYup. If you're running something this critically important on your domain (i.e. pretty much any business doing 7 figure revenue or more), it'd really behoove you to switch to a registrar that supports registry lock on your domain. Then you're protected by the procedures at two unrelated business entities.