4 ms·
Are you aware of how letsencrypt operates, for example? With a single spoofed dns record, you can get an https certificate. A whole lot of infrastructure relies
by uxp8u61q 3y ago
Are you aware of how letsencrypt operates, for example? With a single spoofed dns record, you can get an https certificate. A whole lot of infrastructure relies on DNS for security.
- morelisp 3y agoYou need to spoof at least three records (for the same domain) to get a certificate.
- deathanatos 3y ago…no? Or what are the other two records? If I can control example.com, I can use an http-01 challenge to obtain a cert for example.com. I can't do a dns-01 challenge (that would require _acme-challenge records, although even then, I'm still up to 2, not 3, records), but I don't have to do a necessarily have to do a dns-01 just to get a cert…
- Arnavion 3y agoEven in the dns-01 case you only need the one _acme-challenge record to *get* the cert. You only need more records to be able to do something meaningful with your cert, eg A/AAAA records that point to your malicious server and serve that cert.
- EAtmULFO 3y agoBest practice is to use CAA records, which would help reduce the impact unless the CAA specifies letsencrypt.
- jiggawatts 3y agoIt’s a terrible practice designed to build a moat for billion-dollar corporations feeling scared of free Let’s Encrypt certificates turning off the money printer.
- H8crilA 3y agoTo be fair these days you need to spoof it in at least two locations around the world - they will query you from at least two locations. But yeah, it is bootstrapping security out of seemingly nowhere.
- deleted 3y ago[deleted]
- morelisp 3y agoIf you can control example.com actually on the root NS you should get the cert for example.com! That's not spoofing, that's owning. If you can control the record seen in one datacenter for example.com, you don't get the cert. They check the root NSs from three DCs.
- cortesoft 3y agoThere is a difference between spoofing a record for a specific DNS server and spoofing a global DNS request.
- CaliforniaKarl 3y agoMaybe, but the top thread just said "the validity of a DNS record".
- mike_hock 3y agoIt's beyond me how letsencrypt hasn't been shitlisted, yet.
- NavinF 3y agoWhy? What's your preferred alternative and why is it more secure?
- hsbauauvhabzb 3y agoI don’t have insider knowledge but I feel like a good portion of digicert engineers are basically window-lickers based on some of my insights.