5 ms·
> Domain validated SSL was always a bad idea. It's more like the way domain ownership is validated is awful. If the only way to validate domain ownership was t
by cesarb 12y ago
> Domain validated SSL was always a bad idea.
It's more like the way domain ownership is validated is awful. If the only way to validate domain ownership was to ask the domain owner to create a TXT entry, with both the entry name and its contents being nonces chosen by the certificate authority, it would be much harder to do these attacks (one would have to be able to MITM between the certificate authority and the domain's DNS servers, or compromise the DNS servers).
- userbinator 12y agoI agree, when I first heard about it being based on email validation one of my first thoughts was "owning an email address hosted on a domain does not necessarily mean owning the domain." On the other hand, being able to modify the DNS records is a much stronger proof of ownership.
- cxseven 12y agoIt's no better unless the domain and all such CAs are using DNSSEC.
- MichaelGG 12y agoWell before the sorta recent DNS port fixes, wasn't spoofing a DNS result rather trivial? If you knew where they were going to validate from, you could start spamming spoofed responses for that nonce record. Or do I misunderstand entirely?