3 ms·

> [...] an order to disable https://annas-archive.org https://annas-archive.org through a DNS block [...] Visitors to the site are now greeted by the blocking p

by cesarb 3y ago

> [...] an order to disable https://annas-archive.org https://annas-archive.org through a DNS block [...] Visitors to the site are now greeted by the blocking page below in Italian. To me, this is the most worrying part: how did they get a valid certificate for that "Anna's Archive" domain name, so that their blocking page is shown instead of a certificate mismatch error?

sixhobbits 3y ago
Because the dns records were changed. Same as if you don't pay for your domain, someone else buys it and points records to new IP and generates a new certificate.
- deleted 3y ago
  [deleted]
- wut42 3y ago
  It would not. It is not allowed by the CAB forum. You have to use non third party DNS Resolvers to verify dns-01 certs.
wut42 3y ago
They doesn't. It seems to either not serve anything at all on https, or use a cert that doesn't match annas-archive.org. (Verified using a RIPE Atlas query: https://atlas.ripe.net/measurements/65855880 https://atlas.ripe.net/measurements/65855880 )
yunohn 3y ago
That’s now how DNS blocking work. The default DNS servers used by ISPs reply with the government notice website’s IP address, instead of what other global authoritative resolvers are providing. HTTPS does not prevent this from happening. Instead, I believe you are thinking of DNSSEC (1), which would prevent such dns rebinding. (1) https://www.cloudflare.com/dns/dnssec/how-dnssec-works/ https://www.cloudflare.com/dns/dnssec/how-dnssec-works/
hedora 3y ago
The ACME protocol allows this; you just need to control either the DNS records or port 80 on all of the network paths that the certificate authority (e.g. Let’s Encrypt) uses as part of the challenge response protocol. (Is there a way to permanently opt a DNS name out of such things, I wonder? It seems unlikely that anything would survive a DNS name transfer.)
- SushiHippie 3y ago
  How do you intend to generate a certificate if you opted-out of these methods?
  - hedora 3y ago
    With a traditional Certificate Authority that confirms real-world identities.
    - deleted 3y ago
      [deleted]
- 3np 3y ago
  To some extent, yes: RFC8657 https://community.letsencrypt.org/t/prod-support-for-rfc8657-caa-constraints-for-accounturi-and-validationmethods/181584 https://community.letsencrypt.org/t/prod-support-for-rfc8657... https://www.rfc-editor.org/rfc/rfc8657 https://www.rfc-editor.org/rfc/rfc8657 Though if your threat-model includes local- and/or internet authorities, you probably want to start thinking about alternative roots of trust.

by cesarb 3y ago

sixhobbits 3y ago

Because the dns records were changed. Same as if you don't pay for your domain, someone else buys it and points records to new IP and generates a new certificate.

deleted 3y ago
[deleted]
wut42 3y ago
It would not. It is not allowed by the CAB forum. You have to use non third party DNS Resolvers to verify dns-01 certs.

wut42 3y ago

They doesn't. It seems to either not serve anything at all on https, or use a cert that doesn't match annas-archive.org. (Verified using a RIPE Atlas query: https://atlas.ripe.net/measurements/65855880 https://atlas.ripe.net/measurements/65855880 )

yunohn 3y ago

That’s now how DNS blocking work. The default DNS servers used by ISPs reply with the government notice website’s IP address, instead of what other global authoritative resolvers are providing. HTTPS does not prevent this from happening. Instead, I believe you are thinking of DNSSEC (1), which would prevent such dns rebinding. (1) https://www.cloudflare.com/dns/dnssec/how-dnssec-works/ https://www.cloudflare.com/dns/dnssec/how-dnssec-works/

hedora 3y ago

The ACME protocol allows this; you just need to control either the DNS records or port 80 on all of the network paths that the certificate authority (e.g. Let’s Encrypt) uses as part of the challenge response protocol. (Is there a way to permanently opt a DNS name out of such things, I wonder? It seems unlikely that anything would survive a DNS name transfer.)

SushiHippie 3y ago
How do you intend to generate a certificate if you opted-out of these methods?
- hedora 3y ago
  With a traditional Certificate Authority that confirms real-world identities.
  - deleted 3y ago
    [deleted]
3np 3y ago
To some extent, yes: RFC8657 https://community.letsencrypt.org/t/prod-support-for-rfc8657-caa-constraints-for-accounturi-and-validationmethods/181584 https://community.letsencrypt.org/t/prod-support-for-rfc8657... https://www.rfc-editor.org/rfc/rfc8657 https://www.rfc-editor.org/rfc/rfc8657 Though if your threat-model includes local- and/or internet authorities, you probably want to start thinking about alternative roots of trust.