7 ms·

> Hosting company can not "give" the domain to anybody. > Gitlab used to be like this That's what I'm saying. Hosters can "give" a domain (i.e. control of tha

> Hosting company can not "give" the domain to anybody. > Gitlab used to be like this That's what I'm saying. Hosters can "give" a domain (i.e. control of that domain's records on their nameserver only) to someone else, because they're not registrars and aren't _required_ by some painful business contract with ICANN to have to take change of ownership seriously. They should require a domain validation challenge to add a new domain, like your Gitlab example, but it doesn't seem like anyone can make them. So therefore the onus is currently on the domain owner not to leave their domains' NS records pointing at nameservers they don't control!

nickburns 2y ago
> the onus is currently on the domain owner not to leave their domains' NS records pointing at nameservers they don't control! That's exactly right. That is how this "attack" happens. Bad actor exploits registrant's abandoned yet still authoritative third-party nameservers assignment. Discussion elsewhere in this thread[1] of how some of that responsibility/risk could be spread/shifted onto the DNS provider. [1] https://news.ycombinator.com/item?id=41126976 https://news.ycombinator.com/item?id=41126976
davchana 2y ago
Hosting can't make the challenge. Only way to prove is to make a TXT or cname record. Anybody where tha NS is pointing to, can make any DNS records. Its like you put a lock (NS) on your box (Domain). After few months you don't care about that box anymore and leave that key in the wild. Anybody can pick that key and use the box. The box holder (domain registrar) can't make you verify that you are the original owner 'by' asking you to open the box, because by default, anybody who has key, can open the box. The correct way & responsible way is to destroy the box (delete the domain) or at least destroy the key (unpoint the third party NS records).

nickburns 2y ago

> the onus is currently on the domain owner not to leave their domains' NS records pointing at nameservers they don't control! That's exactly right. That is how this "attack" happens. Bad actor exploits registrant's abandoned yet still authoritative third-party nameservers assignment. Discussion elsewhere in this thread[1] of how some of that responsibility/risk could be spread/shifted onto the DNS provider. [1] https://news.ycombinator.com/item?id=41126976 https://news.ycombinator.com/item?id=41126976

davchana 2y ago

Hosting can't make the challenge. Only way to prove is to make a TXT or cname record. Anybody where tha NS is pointing to, can make any DNS records. Its like you put a lock (NS) on your box (Domain). After few months you don't care about that box anymore and leave that key in the wild. Anybody can pick that key and use the box. The box holder (domain registrar) can't make you verify that you are the original owner 'by' asking you to open the box, because by default, anybody who has key, can open the box. The correct way & responsible way is to destroy the box (delete the domain) or at least destroy the key (unpoint the third party NS records).