3 ms·

This is a fantastic exploit and I am appalled that CAs are still trying to use whois for this kind of thing. I expected the rise of the whois privacy services a

by fanf2 2y ago

This is a fantastic exploit and I am appalled that CAs are still trying to use whois for this kind of thing. I expected the rise of the whois privacy services and privacy legislation would have made whois mostly useless for CAs years ago. << maintainers of WHOIS tooling are reluctant to scrape such a textual list at runtime, and so it has become the norm to simply hardcode server addresses, populating them at development time by referring to IANA’s list manually. Since the WHOIS server addresses change so infrequently, this is usually an acceptable solution >> This is the approach taken by whois on Debian. Years ago I did some hacking on FreeBSD’s whois client, and its approach is to have as little built-in hardcoded knowledge as possible, and instead follow whois referrals. These are only de-facto semi-standard, i.e. they aren’t part of the protocol spec, but most whois servers provide referrals that are fairly easy to parse, and the number of exceptions and workarounds is easier to manage than a huge hardcoded list. FreeBSD’s whois starts from IANA’s whois server, which is one of the more helpful ones, and it basically solves the problem of finding TLD whois servers. Most of the pain comes from dealing with whois for IP addresses, because some of the RIRs are bad at referrals. There are some issues with weird behaviour from some TLD whois servers, but that’s relatively minor in comparison.

tialaramex 2y ago
Today the Certificate Authorities in the Web PKI use the "Ten Blessed Methods" (there are in fact no longer ten of them, but that's what I'm going to keep calling them). [[ Edited to add: I remembered last time I mentioned these some people got confused. The requirement is a CA must use at least one of the blessed methods, there used to be "Any other method" basically they could do whatever they wanted and that "method" was of course abused beyond belief which is why it's gone. They can do whatever they like in addition, and there are also some (largely not relevant) checks which are always mandatory, but these "blessed methods" are the core of what prevents you from getting a certificate for say the New York Times websites ]] https://cabforum.org/working-groups/server/baseline-requirements/documents/ https://cabforum.org/working-groups/server/baseline-requirem... The Ten Blessed Methods are listed in section 3.2.2.4 of the Baseline Requirements, there are currently twenty sub-sections corresponding to what the Forum considers distinct methods, the newer ones unsurprisingly are later in the list, although many are retired (no longer permitted for use) 3.2.2.4.2 "Email, Fax, SMS, or Postal Mail to Domain Contact" specifically says to check whois as does 3.2.2.4.15 "Phone Contact with Domain Contact". For the commercial CAs this is all bad for their bottom line, because a willing customer can't buy their product due to some bureaucratic problem. They want to give you $50, but they can't because some IT bloke needs to update a field in some software. When they ask the IT guy "Hey, can you update this field so I can buy a $50 certificate" the IT guy is going to say "Oh, just use Let's Encrypt" and you don't get $50. So you want to make it as easy as possible to give you $50. Bad for the Internet's Security? Who cares. ISRG (the Let's Encrypt CA) of course doesn't care about $$$ because the certificates do not cost money, only the provisioning infrastructure costs money, so they only implement 3.2.2.4.7, 3.2.2.4.19 and 3.2.2.4.20 IIRC because those make sense to automate and have reasonable security assuming no bugs.
remram 2y ago
Wouldn't it be easy for those software project, or a single central authority, to expose that WHOIS list through DNS? mobi.whoisserverlist.info. IN CNAME whois.nic.mobi. org.whoisserverlist.info. IN CNAME whois.publicinterestregistry.org. The presence of a referral mechanism inside the WHOIS protocol strikes me as a little odd.
- vdqtp3 2y ago
  You mean like an SRV record? https://circleid.com/posts/whois_server_address_registry/ https://circleid.com/posts/whois_server_address_registry/
  - remram 2y ago
    Yes that works too. Thanks! Though this relies on registrar publishing their own, and some don't. I meant that some other authority could publish them all, if they are known. edit: It seems like {tld}.whois-servers.net is exactly that, CNAME to whois servers. Your link mentioned it. Thanks again.
- fanf2 2y ago
  I believe the original reason for referrals was related to the breakup of the Network Solutions DNS monopoly. This led to the split between TLD registries (who run the DNS servers) and registrars (who sell domain names). To enforce the split for the big TLDs .com, .net, .org, the registration database was also split so that Network Solutions could not directly know the customer who registered each domain, but only the registrar who sold it. This was known as the “thin registry” model. From the whois perspective, this meant that when you asked about example.com, the Network Solutions whois server would only provide information about the registrar; the whois client could follow the referral to get information about the actual registrant from the registrar. Basically all the other TLDs have a “thick registry” where the TLD operator has all the registration details so there’s no need for whois referrals to registrars. As a result, a whois client needs referral support. The top level IANA whois server has good referral data, so there isn’t much to gain from trying to bypass it.

by fanf2 2y ago

tialaramex 2y ago

Today the Certificate Authorities in the Web PKI use the "Ten Blessed Methods" (there are in fact no longer ten of them, but that's what I'm going to keep calling them). [[ Edited to add: I remembered last time I mentioned these some people got confused. The requirement is a CA must use at least one of the blessed methods, there used to be "Any other method" basically they could do whatever they wanted and that "method" was of course abused beyond belief which is why it's gone. They can do whatever they like in addition, and there are also some (largely not relevant) checks which are always mandatory, but these "blessed methods" are the core of what prevents you from getting a certificate for say the New York Times websites ]] https://cabforum.org/working-groups/server/baseline-requirements/documents/ https://cabforum.org/working-groups/server/baseline-requirem... The Ten Blessed Methods are listed in section 3.2.2.4 of the Baseline Requirements, there are currently twenty sub-sections corresponding to what the Forum considers distinct methods, the newer ones unsurprisingly are later in the list, although many are retired (no longer permitted for use) 3.2.2.4.2 "Email, Fax, SMS, or Postal Mail to Domain Contact" specifically says to check whois as does 3.2.2.4.15 "Phone Contact with Domain Contact". For the commercial CAs this is all bad for their bottom line, because a willing customer can't buy their product due to some bureaucratic problem. They want to give you $50, but they can't because some IT bloke needs to update a field in some software. When they ask the IT guy "Hey, can you update this field so I can buy a $50 certificate" the IT guy is going to say "Oh, just use Let's Encrypt" and you don't get $50. So you want to make it as easy as possible to give you $50. Bad for the Internet's Security? Who cares. ISRG (the Let's Encrypt CA) of course doesn't care about $$$ because the certificates do not cost money, only the provisioning infrastructure costs money, so they only implement 3.2.2.4.7, 3.2.2.4.19 and 3.2.2.4.20 IIRC because those make sense to automate and have reasonable security assuming no bugs.

remram 2y ago

Wouldn't it be easy for those software project, or a single central authority, to expose that WHOIS list through DNS? mobi.whoisserverlist.info. IN CNAME whois.nic.mobi. org.whoisserverlist.info. IN CNAME whois.publicinterestregistry.org. The presence of a referral mechanism inside the WHOIS protocol strikes me as a little odd.

vdqtp3 2y ago
You mean like an SRV record? https://circleid.com/posts/whois_server_address_registry/ https://circleid.com/posts/whois_server_address_registry/
- remram 2y ago
  Yes that works too. Thanks! Though this relies on registrar publishing their own, and some don't. I meant that some other authority could publish them all, if they are known. edit: It seems like {tld}.whois-servers.net is exactly that, CNAME to whois servers. Your link mentioned it. Thanks again.
fanf2 2y ago
I believe the original reason for referrals was related to the breakup of the Network Solutions DNS monopoly. This led to the split between TLD registries (who run the DNS servers) and registrars (who sell domain names). To enforce the split for the big TLDs .com, .net, .org, the registration database was also split so that Network Solutions could not directly know the customer who registered each domain, but only the registrar who sold it. This was known as the “thin registry” model. From the whois perspective, this meant that when you asked about example.com, the Network Solutions whois server would only provide information about the registrar; the whois client could follow the referral to get information about the actual registrant from the registrar. Basically all the other TLDs have a “thick registry” where the TLD operator has all the registration details so there’s no need for whois referrals to registrars. As a result, a whois client needs referral support. The top level IANA whois server has good referral data, so there isn’t much to gain from trying to bypass it.