elliottinvent

10 ms·

1. 31.▲
   by elliottinvent 3y ago

   Thanks for your question. > Let's Encrypt together with tools like Cerbot have brought easy to use proof of domain ownership to countless sites. Why wouldn't services that want to verify domain ownership use that? I think the a
2. 32.▲
   by elliottinvent 3y ago

   I might have misunderstood you, but brute force what exactly? Sure, you could use your GPU to generate hashes for 500m email addresses / phones (if they weren't already pre-generated) but then what? You'd need to then run a D
3. 33.▲
   by elliottinvent 3y ago

   Really interesting point, thanks. > Does this mean this service doesn't work if you use unique email addresses for different services? It wouldn't work "out of the box". The DNS record is stored at a DNS location base
4. 34.▲
   by elliottinvent 3y ago

   > That would imply if someone signs up for a service I am not using (with my verified domain), I am going to receive an email or other sort of verification request. Your domain is verified by each service provider using the protocol, so
5. 35.▲
   by elliottinvent 3y ago

   Huge thanks for pointing these out. I moved the spec to /docs/spec very recently and forgot to update that link on homepage – fixed now. "Emali" is a new typo for me, will fix that in the DNS record, thanks.
6. 36.▲
   by elliottinvent 3y ago

   Thanks for your feedback. > So whats the actual verification process look like? You give the SP the subdomain generated and they query TXT records from there? how does the actual verification work here and when/how does the user rec
7. 37.▲
   by elliottinvent 3y ago

   A deleted question, that I had typed out a response for but couldn't submit because it was deleted (in case it helps anyone): >> Why not just make a browser plugin that scrapes the screen when the user is presented a txt record t
8. 38.▲
   by elliottinvent 3y ago

   1. One record can be used by all service providers (set and forget) 2. Records could be created automatically upon domain registration (with opt-in) The current IETF standards don't enable either of the above.
9. 39.▲
   by elliottinvent 3y ago

   The implementer being e.g. Facebook? If I understand your argument correctly, you are saying: "I'm Facebook, why would I go to the trouble of asking my users to create a Domain Verification record and verifying their email? Especi
10. 40.▲
    by elliottinvent 3y ago

    Great question, thanks. If the Verifiable Identifier is not salted first, and the attacker is determined to match a particular domain to a hash in a rainbow table of hundreds of millions of email addresses / phone numbers, then the ans
11. 41.▲
    by elliottinvent 3y ago

    Thanks for taking a look and for your comments. > If I understand correctly, you need to submit the verifiable identifiers (email address and optional salt) to the party where you need to verify. The verifiable identifier is the email&#x
12. 42.▲
    by elliottinvent 3y ago

    Thanks for taking a look. I think you might have missed an important part of this (perhaps I overlooked to explain this part more thoroughly) – the "verifiable identifier" (e.g. telephone number or email address) still needs to be
13. 43.▲
    by elliottinvent 3y ago

    Thanks very much! I've still got some work to do on it but I'm now at a stage where I need more people looking at it and giving feedback. Thanks for yours.
14. 44.▲
    by elliottinvent 3y ago

    I forgot to mention, verifiable identifiers can optionally be salted before hashing but this introduces a dependency on the creator of the domain verification record to share the salt.
15. 45.▲
    Show HN: Make domain verification as easy as verifying an email or phone number(domainverification.org)

    86 points by elliottinvent 3y ago|63 comments
16. 46.▲
    by elliottinvent 3y ago

    Thanks for taking a look and for your comment. Another key difference is that the _atproto TXT record is discoverable since it’s always at _atproto. Whereas the “verifiable identifier” I use isn’t discoverable because it’s hashed and used a
17. 47.▲
    by elliottinvent 3y ago

    They definitely should have used HTTP-01 if they’re doing verification on the web, but since this is about using a domain as identity this really belongs in DNS. The issue with DNS-01 (and HTTP-01 to a lesser extent) as someone else mention
18. 48.▲
    A Short History of My Last Six Years(waitbutwhy.com)

    3 points by elliottinvent 4y ago|1 comments
19. 49.▲
    by elliottinvent 4y ago

    For anyone working on a side project that became all consuming.
20. 50.▲
    by elliottinvent 4y ago

    You're missing DNS TXT which tends to reveal a lot about the services any company uses due to standard methods of domain verification. % dig tesla.com TXT tesla.com. 3600 IN TXT "adobe-idp-site-verification=321c026a-3a8c-4206-a1f
21. 51.▲
    by elliottinvent 5y ago

    I’m from the UK > Except nobody should actually be paying $22.80 for generic Prozac. You can drive to any local Walmart and get it for $4 and they will bill your insurance, which will count toward your deductible. FWIW I thought this mea
22. 52.▲
    by elliottinvent 5y ago

    > I hate MS login page and endless redirects between their services I dread logging into any Microsoft product for this reason, I just know it’s 30 mins of BS trying to find different passwords for different accounts, none of which relat
23. 53.▲
    by elliottinvent 5y ago

    If anyone has any feedback on using zonefiles.io I’d be interested to hear it
24. 54.▲
    by elliottinvent 5y ago

    You can download zone files for lots of gTLDs using ICANN’s Centralized Zone Data Service [0]. For ccTLDs there’s no centralised system and availability depends on the country registry. For example, Nominet make the UK zone file and others
25. 55.▲
    by elliottinvent 5y ago

    I guess it depends on how interested you are in what’s going on in the world, whether it’s relevant to you or not. Even if I was just to look at the news that directly relevant to me, there’s plenty that (rightly) doesn’t make it to HN. For
26. 56.▲
    by elliottinvent 5y ago

    Yes, otherwise you'll miss out on world events that are important but not necessarily interesting to hackers.
27. 57.▲
    by elliottinvent 5y ago

    > Monopolies, lobbying and protectionism got in the way of keeping the web truly machine readable. Exactly and that ship has long since sailed. The good ship Web 3.0 (semantic web) launched in ‘99 and was a ghost ship until recently when
28. 58.▲
    by elliottinvent 5y ago

    Exactly. In my view the crypto community have hijacked the name coined by timbl because calling it web4 would have highlighted that web3.0 (the semantic web) failed, at least outside academia. Wikipedia has two articles, it’s all about the
29. 59.▲
    by elliottinvent 5y ago

    "We decided to charge Foundation DNS based on a single input for our enterprise customers: Total DNS queries per month." Great, but how much per 1/million/billion queries?
30. 60.▲
    by elliottinvent 5y ago

    This is what I came here to say. I think FAQs for edge cases or very specific questions are very useful. FAQs can also be a good way to address negative stuff and especially naysayers of a technology or concept - it's difficult to do t