3 ms·
Quite simple really. Imagine you buy a domain (e.g. foo.com) and park it on some popular registrar. Many of those create a few "CNAME" DNS records like ftp.foo.
by alexandrfox 3y ago
Quite simple really. Imagine you buy a domain (e.g. foo.com) and park it on some popular registrar. Many of those create a few "CNAME" DNS records like ftp.foo.com, mail.foo.com, etc. by default. Then you decide to use Shopify with this domain you bought, so you modify its "A" DNS record to point to Shopify's IP address. Boom, you're now susceptible to this "attack" -- >anyone< can go ahead and register a Shopify account and attach one of your dangling subdomains to it!
- Exuma 3y agoBut why would shopify ever treat a subdomain as an entirely separate store outside of the main domain? That makes no sense. If i register xyz.example.com as my store, then that should just be in my ONE account which verifies example.com, then by adding a second store, i can only add it as a subdomain from that main account, not just an entirely separate account. Or, lets say its a separate account, then it should make me add records from that NEW account, even if there are already existing records. So i still dont understand how this is possible
- alexandrfox 3y agoYes, that makes no sense, but that's how it is, because Shopify allows it. My friend's subdomain got taken over like that just a couple weeks ago.