6 ms·

I think the DNS provider is missing some due diligence. What happens is Alice creates some DNS records for example.com which is registered elsewhere. Everythin

by nickcw 2y ago

I think the DNS provider is missing some due diligence. What happens is Alice creates some DNS records for example.com which is registered elsewhere. Everything is fine. At some point (maybe Alice forgets to pay the bill) the DNS records expire. A bit later Bob makes an account at the same DNS provider and makes DNS records for example.com. This is possible because Alice's records have been deleted. Bob has now effectively taken over example.com The due diligence missing is that the provider could have kept a record that the DNS records were owned by Alice. They should have been asking questions (or doing additional validation) when Bob tried to create new ones for example.com.

CGamesPlay 2y ago
My question is, after this point, can Alice reclaim her domain? Is there any way to automate verification of domain name ownership outside without DNS?
- OccamsMirror 2y ago
  She just needs to change her nameservers at the registrar level.
- OJFord 2y ago
  She hasn't lost the domain, she's lost the ability to control its DNS at the provider she's currently using (the nameservers she set). So as sibling says it's a case of changing the ns to some other provider, or else I suppose a support case to somehow prove you do own the domain, so please assign control back to your account.
  - jsheard 2y ago
    Well, if the email address you use at the registrar is under the domain the attacker now controls, they can hijack it and potentially escalate to taking over your registrar account as well. Hopefully you have 2FA set up and your registrar enforces it properly.
    - 3np 2y ago
      And, y'know, use a separate domain for admin email.
- detourdog 2y ago
  DNS is the verification of ownership. Paying your bill and having a receipt is the verification.
  - detourdog 2y ago
    Thinking back more I realize that when I first registered my domain there was no money involved. I remember when ethical discussions of charging for domain names. The justification is that buying the domain name proved ownership. I suppose it was also meant to discourage people piping dict into the registration process. There was a land rush for nouns such as pets.com.
hk__2 2y ago
> The due diligence missing is that the provider could have kept a record that the DNS records were owned by Alice. They should have been asking questions (or doing additional validation) when Bob tried to create new ones for example.com. Isn’t that this covered by e.g. OVH that sends you at least a dozen of emails before your domain expires?
- lelanthran 2y ago
  > Isn’t that this covered by e.g. OVH that sends you at least a dozen of emails before your domain expires? In this "attack" the domain is not expired.
- nickcw 2y ago
  This is the DNS records expiring rather than the domain. On most providers DNS records are provided for free as part of having other services (eg a VM) so there is no incentive for the provider to nag you about your DNS records expiring. They are very likely to nag you about your VM expiring without mentioning the DNS records.
belorn 2y ago
> A bit later Bob makes an account at the same DNS provider and makes DNS records for example.com. A dns company that goes into commercial relationship with a customer should try to prevent themselves from being used in a crime. DNS registrars are already very much used to this since fraudulent registrations are common place, and top registries generally demand some minimum standards when dealing with it. It is not a major leap to demand something similar from dns services. The issue is kind of similar to account creation bugs, where a user name ALICE (all caps) can masquerader as user Alice. If the new user claims to be alice, they either have to log in with the old account (alt using an account restoration process), or they have to validate that they are in control of the domain name. Validating a sub domain is fairly easy, but even a bare domain is doable using unique ns records, alternatively using any third-party validations (e-id, company registrations, etc.) that other part of society is already using for validation. I see this as a purely dns industry problem that can be solved using existing tools and expectations.
marcosdumay 2y ago
How can the DNS provider decide if Alice actually wants Bob to set her DNS, or if Bob is doing it without permission? You just shouldn't point your domain into DNS providers that aren't providing DNS for you. If you go and add them to your domain, it's reasonable for the provider to decide that what they are doing is correct. Anything you add here (are people thinking about some hard to write TXT record? It surely looks like so) will break more things than it fixes.
- nickburns 2y ago
  Verification link sent to registrant's email address. Change not processed until verification occurs. This is generally the level of diligence (i.e. emailed verification link) that registrars are held to. DNS providers should be held to the same when the requesting account isn't the same account that created the 'earlier' zone file for a given domain at the very same provider.
  - marcosdumay 2y ago
    Lots and lots of people don't use their own emails on the DSN information. Maybe we should add a requirement that the zone register sends some notification on behalf of the DNS provider. That could work, at least on the TLD level.
    - nickburns 2y ago
      Registrant contact information is maintained by the registrar. The failure of a Registered Name Holder[1] to furnish up-to-date contact information with its Registrar[2] may result in the forfeiture of rights[3] up to and including the suspension or cancellation of the registration itself.[4] Point being that, short of transfer Auth-Codes[5], a verification link sent to the registrant's email address by the DNS provider is the functional equivalent of nearly the most that a registrar may be required to do in order to contact and/or verify a registrant. [1] https://www.icann.org/resources/pages/ra-agreement-2009-05-21-en#1.8 https://www.icann.org/resources/pages/ra-agreement-2009-05-2... [2] https://www.icann.org/resources/pages/ra-agreement-2009-05-21-en#1.9 https://www.icann.org/resources/pages/ra-agreement-2009-05-2... [3] https://www.icann.org/resources/pages/benefits-2013-09-16-en https://www.icann.org/resources/pages/benefits-2013-09-16-en [4] https://www.icann.org/resources/pages/registration-data-accurate-2023-11-02-en https://www.icann.org/resources/pages/registration-data-accu... [5] https://www.icann.org/resources/pages/auth-2013-05-03-en https://www.icann.org/resources/pages/auth-2013-05-03-en

by nickcw 2y ago

CGamesPlay 2y ago

My question is, after this point, can Alice reclaim her domain? Is there any way to automate verification of domain name ownership outside without DNS?

OccamsMirror 2y ago
She just needs to change her nameservers at the registrar level.
OJFord 2y ago
She hasn't lost the domain, she's lost the ability to control its DNS at the provider she's currently using (the nameservers she set). So as sibling says it's a case of changing the ns to some other provider, or else I suppose a support case to somehow prove you do own the domain, so please assign control back to your account.
- jsheard 2y ago
  Well, if the email address you use at the registrar is under the domain the attacker now controls, they can hijack it and potentially escalate to taking over your registrar account as well. Hopefully you have 2FA set up and your registrar enforces it properly.
  - 3np 2y ago
    And, y'know, use a separate domain for admin email.
detourdog 2y ago
DNS is the verification of ownership. Paying your bill and having a receipt is the verification.
- detourdog 2y ago
  Thinking back more I realize that when I first registered my domain there was no money involved. I remember when ethical discussions of charging for domain names. The justification is that buying the domain name proved ownership. I suppose it was also meant to discourage people piping dict into the registration process. There was a land rush for nouns such as pets.com.

hk__2 2y ago

> The due diligence missing is that the provider could have kept a record that the DNS records were owned by Alice. They should have been asking questions (or doing additional validation) when Bob tried to create new ones for example.com. Isn’t that this covered by e.g. OVH that sends you at least a dozen of emails before your domain expires?

lelanthran 2y ago
> Isn’t that this covered by e.g. OVH that sends you at least a dozen of emails before your domain expires? In this "attack" the domain is not expired.
nickcw 2y ago
This is the DNS records expiring rather than the domain. On most providers DNS records are provided for free as part of having other services (eg a VM) so there is no incentive for the provider to nag you about your DNS records expiring. They are very likely to nag you about your VM expiring without mentioning the DNS records.

belorn 2y ago

> A bit later Bob makes an account at the same DNS provider and makes DNS records for example.com. A dns company that goes into commercial relationship with a customer should try to prevent themselves from being used in a crime. DNS registrars are already very much used to this since fraudulent registrations are common place, and top registries generally demand some minimum standards when dealing with it. It is not a major leap to demand something similar from dns services. The issue is kind of similar to account creation bugs, where a user name ALICE (all caps) can masquerader as user Alice. If the new user claims to be alice, they either have to log in with the old account (alt using an account restoration process), or they have to validate that they are in control of the domain name. Validating a sub domain is fairly easy, but even a bare domain is doable using unique ns records, alternatively using any third-party validations (e-id, company registrations, etc.) that other part of society is already using for validation. I see this as a purely dns industry problem that can be solved using existing tools and expectations.

marcosdumay 2y ago

How can the DNS provider decide if Alice actually wants Bob to set her DNS, or if Bob is doing it without permission? You just shouldn't point your domain into DNS providers that aren't providing DNS for you. If you go and add them to your domain, it's reasonable for the provider to decide that what they are doing is correct. Anything you add here (are people thinking about some hard to write TXT record? It surely looks like so) will break more things than it fixes.

nickburns 2y ago
Verification link sent to registrant's email address. Change not processed until verification occurs. This is generally the level of diligence (i.e. emailed verification link) that registrars are held to. DNS providers should be held to the same when the requesting account isn't the same account that created the 'earlier' zone file for a given domain at the very same provider.
- marcosdumay 2y ago
  Lots and lots of people don't use their own emails on the DSN information. Maybe we should add a requirement that the zone register sends some notification on behalf of the DNS provider. That could work, at least on the TLD level.
  - nickburns 2y ago
    Registrant contact information is maintained by the registrar. The failure of a Registered Name Holder[1] to furnish up-to-date contact information with its Registrar[2] may result in the forfeiture of rights[3] up to and including the suspension or cancellation of the registration itself.[4] Point being that, short of transfer Auth-Codes[5], a verification link sent to the registrant's email address by the DNS provider is the functional equivalent of nearly the most that a registrar may be required to do in order to contact and/or verify a registrant. [1] https://www.icann.org/resources/pages/ra-agreement-2009-05-21-en#1.8 https://www.icann.org/resources/pages/ra-agreement-2009-05-2... [2] https://www.icann.org/resources/pages/ra-agreement-2009-05-21-en#1.9 https://www.icann.org/resources/pages/ra-agreement-2009-05-2... [3] https://www.icann.org/resources/pages/benefits-2013-09-16-en https://www.icann.org/resources/pages/benefits-2013-09-16-en [4] https://www.icann.org/resources/pages/registration-data-accurate-2023-11-02-en https://www.icann.org/resources/pages/registration-data-accu... [5] https://www.icann.org/resources/pages/auth-2013-05-03-en https://www.icann.org/resources/pages/auth-2013-05-03-en