3 ms·
This is kinda how it works, but not how it would work in practice. The issue would be more like: 1. Register your domain with namecheap, and you want to have
by cortesoft 2y ago
This is kinda how it works, but not how it would work in practice.
The issue would be more like:
1. Register your domain with namecheap, and you want to have digital ocean run your DNS, so you point the domain to use their name servers.
2. A few months later, you decide to stop using digital ocean DNS, so you delete all your records… but you forget to change your NS record at namecheap, so now someone else can now add that DNS name to their digital ocean account.
This would only happen if your aren’t actively using the DNS name, which would allow you to have it point to a NS you aren’t controlling.
- layer8 2y agoBut the easy fix is just to change the NS records back to something you control. Somehow I don’t understand the problem.
- NoahKAndrews 2y agoIt's easy to fix if you own the domain, but it still happens. The idea is to find ways to address the problem with the DNS providers so that it doesn't happen at all.
- cortesoft 2y agoThe point is some people will forget. It is not a huge security hole, but just something that will cause issues for some people.
- davchana 2y agoGitlab also had same issue few weeks ago. Gitlab, once static pages are published, gives you a URL with gitlab.io ending. You can use your custom domain or subdomain by pointing CNAME or A record to Gitlab. What users would do is, add DNS records to their DNS Manager to point their custom domain to Gitlab Pages, later will delete the Gitlab pages when not wanted any more. Scammer will simply point that same domain to his fake repository, thus hijacking customer domain. Gitlab then made customer add a Txt Record for verification of domain. Scammer's txt record value is different from customer txt record, scammer can't modify DNS records.
- apitman 2y agoIs there a similar mitigation that would work when you're using the 3rd party nameservers (a la Cloudflare), and not just a CNAME?