3 ms·
My domain name is under my control and therefore should not point to servers I do not trust. If one's domain name points to an untrusted server, a very fundamen
by susam 6y ago
My domain name is under my control and therefore should not point to servers I do not trust. If one's domain name points to an untrusted server, a very fundamental mistake has been made and no amount of configuration can fix the issues associated with it.
Webmasters we have two things in control:
1. Their domain name. It should point to trusted servers only.
2. Their web server. It should be configured to return successful responses only for domain names they care about and no response/error for everything else.
- detaro 6y agoThe configuration fixing it for the domain owner is very simple: update your DNS so it doesn't point to a server you don't control anymore. OP observed someone made that mistake and is posting a PSA "hey, remember that that's a thing and don't do it because it's bad". If that's obvious to you and you never make that mistake, great, you are not the target, but real-world experience shows that it happens all the time.
- harikb 6y agoJust curious - can you explain #2 ? I get that someone can register some freebitcoin.xyz and point to your IP, but the content is still controlled by you, right? What is the security angle here if your host returned a static index.html to any host? Some CSRF? Edit: only asking for cases where #1 does not apply - that is you don’t have domains or sub-domains pointing at rogue IPs
- detaro 6y agoIf it's just an empty placeholder, not much. if it's your actual site or app there could be various issues, e.g. with search engines, people actually using/being tricked into using the app through the wrong domain and having cookies associated wrongly, bad content on subdomains being associated with you, ...