4 ms·

It raises my eyebrow that a third party controls MSN, Google, and Facebook's DNS entries while also being a trusted certificate authority. This makes a man-in-t

by ynniv 15y ago

It raises my eyebrow that a third party controls MSN, Google, and Facebook's DNS entries while also being a trusted certificate authority. This makes a man-in-the-middle SSL attack "somewhat easy". Does anyone publicly audit the DNS entries of major services? I haven't heard of any browsers alerting on SSL certificate changes (a la ~/.ssh/known_hosts). Perhaps I like my tinfoil hat more than the average Joe, but this sounds like an excellent way to execute wiretaps. I can only imagine that http://news.ycombinator.com/item?id=3929507 http://news.ycombinator.com/item?id=3929507 reminded the submitter of this old (Feb 17th) paste.

deleted 15y ago
[deleted]
sneak 15y ago
They are the REGISTRAR of the domains - they are not hosting DNS for the domains. The fact that they manage the registration is completely irrelevant from a wiretapping point-of-view. If true, the fact that they have a CA is what allows them to wiretap. But they don't need control of DNS to do that - just cooperation of an ISP.
- ynniv 15y ago
  The fact that they manage the registration is completely irrelevant from a wiretapping point-of-view. As the registrar, you specify which DNS servers are authoritative for the domain. It is much easier for the registrar to quietly change a domain than any other 3rd party in the system. That in itself isn't scary. Lots of people use(d) GoDaddy, eNom, etc. Another commenter pointed out that Last.fm likes the service because it abstracts the pain of domain registration. But does Google care about the pain of registering Google in new TLDs? Does Facebook worry that their domain will expire due to an out of date credit card? Using a third party service introduces risk of failures out of your control. Any interruption to these major providers will cause damage far in excess of them not having to deal with spam domains. Consolidation when consolidation is unnecessary should raise questions.
  - sneak 15y ago
    If you think it's possible for anyone, registrar or no, to "quietly" change the NS records for google.com., you're confused.
    - deleted 15y ago
      [deleted]
    - harshreality 15y ago
      Not instantly, because google.com's glue records have a 2-day TTL. Verisign has the ability to alter DNS glue records for .com and they have the ability to issue browser-trusted certificates, except in cases of browser cert pinning functionality or extensions (like CertPatrol) that check for certs being altered before they're nearly expired. Registrars can instruct Verisign to alter the glue records for .com domains. Are you saying Verisign has special policies in place to double check with major companies before changing their respective glue records?
      - ynniv 15y ago
        Do any browsers pin certs by default? I haven't heard of CertPatrol, but alerting when a cert changes well before expiration seems like good default.
        harshreality 15y ago
        Chrome has certain google.com certificates (maybe all of them) pinned. {accounts, mail, docs}.google.com (at least) have HSTS forced and preloaded in Chrome, but www.google.com does not.
        cleverjake 15y ago
        I'd love to see where you found this information. I wasn't able to find it in Chrome's source, but I didn't have the change to do a deep dive.

by ynniv 15y ago

deleted 15y ago

[deleted]

sneak 15y ago

They are the REGISTRAR of the domains - they are not hosting DNS for the domains. The fact that they manage the registration is completely irrelevant from a wiretapping point-of-view. If true, the fact that they have a CA is what allows them to wiretap. But they don't need control of DNS to do that - just cooperation of an ISP.

ynniv 15y ago
The fact that they manage the registration is completely irrelevant from a wiretapping point-of-view. As the registrar, you specify which DNS servers are authoritative for the domain. It is much easier for the registrar to quietly change a domain than any other 3rd party in the system. That in itself isn't scary. Lots of people use(d) GoDaddy, eNom, etc. Another commenter pointed out that Last.fm likes the service because it abstracts the pain of domain registration. But does Google care about the pain of registering Google in new TLDs? Does Facebook worry that their domain will expire due to an out of date credit card? Using a third party service introduces risk of failures out of your control. Any interruption to these major providers will cause damage far in excess of them not having to deal with spam domains. Consolidation when consolidation is unnecessary should raise questions.
- sneak 15y ago
  If you think it's possible for anyone, registrar or no, to "quietly" change the NS records for google.com., you're confused.
  - deleted 15y ago
    [deleted]
  - harshreality 15y ago
    Not instantly, because google.com's glue records have a 2-day TTL. Verisign has the ability to alter DNS glue records for .com and they have the ability to issue browser-trusted certificates, except in cases of browser cert pinning functionality or extensions (like CertPatrol) that check for certs being altered before they're nearly expired. Registrars can instruct Verisign to alter the glue records for .com domains. Are you saying Verisign has special policies in place to double check with major companies before changing their respective glue records?
    - ynniv 15y ago
      Do any browsers pin certs by default? I haven't heard of CertPatrol, but alerting when a cert changes well before expiration seems like good default.
      - harshreality 15y ago
        Chrome has certain google.com certificates (maybe all of them) pinned. {accounts, mail, docs}.google.com (at least) have HSTS forced and preloaded in Chrome, but www.google.com does not.
        cleverjake 15y ago
        I'd love to see where you found this information. I wasn't able to find it in Chrome's source, but I didn't have the change to do a deep dive.