4 ms·
If you want to prove domain ownership, you have to do it at the domain level. The ability to serve a file “www.example.com” in no way demonstrates ownership of
by efitz 3y ago
If you want to prove domain ownership, you have to do it at the domain level.
The ability to serve a file “www.example.com” in no way demonstrates ownership of “example.com”; it demonstrates that you control www.example.com.
If you want to prove ownership of a second level domain you must do it through a record in DNS, or through demonstrating control of something that is publicly known to control the domain such as the administrative contact emails.
This really is a solved problem in the PKI space; they should have borrowed that rather than invent their own.
- steveklabnik 3y agoAs said multiple times in this thread, the primary way of identifying yourself in this protocol is a TXT record in DNS.
- gkbrk 3y agoThe "primary" way doesn't really matter if a user checks their app and sees that it was verified. Unless the UI makes it clear it was verified with "non-primary" methods so users can be cautious, any method of verification is essentially "primary" from the user POV.
- steveklabnik 3y agoYes. It is a problem that this method has issues. They’ll be fixed. My point is, they did not ignore that case, they focused on it! This is just a bug in an additional method.