3 ms·
I think that this is a common way of verifying domain ownership, but something harder to spoof without actually owning the domain, like setting a custom TXT rec
by macNchz 11y ago
I think that this is a common way of verifying domain ownership, but something harder to spoof without actually owning the domain, like setting a custom TXT record or being able to respond to a WHOIS contact email would seem to make more sense than file upload.
- ikeboy 11y agoEven if this is common, you have to expect fake certs will be easier to get if there's no cost in failure. If you need to pay for a cert before seeing if your hack worked, there will be less attempts. This way, if your mitm failed, you didn't lose anything.