5 ms·

Webserver control is never used and must not be used to prove domain ownership. If you're pwned and have to re-point to a server stood up from backup, having re

Webserver control is never used and must not be used to prove domain ownership. If you're pwned and have to re-point to a server stood up from backup, having registrar relying on someone being able to put up a random file on a compromised machine would be a total security disaster.

sandeepkd 2mo ago
To clarify, my observation is around how it might have happened, not if this is the right way to do it
sandeepkd 2mo ago
On a different note, adding a file on webserver is one of the ACME methods (HTTP-01) to get a SSL/TLS certificate so it is indeed considered as possession method in real world already
- maxgashkov 2mo ago
  You're missing that HTTP-01 challenge grants you no ability beyond what the check has demonstrated, i.e. you have proven that you're able to serve random file from a webserver, so the grant is to allow you to serve them via TLS connection. There are no comparable _technical_ proof-of-registration methods because all of them would require actual access to registrar control panel and be outright silly ('point the domain to a random nameserver'). So no, proper registrars never use webserver control as means to prove identity or ownership.
  - sandeepkd 2mo ago
    > you have proven that you're able to serve random file from a webserver, so the grant is to allow you to serve them via TLS connection. Its digression from the original topic, still, it goes way far than that, these certificates are signed by a CA that the client devices trusts by the virtue of root certificates installed on the device. If I can some how obtain the SSL/TLS certificate for google then thats a very big deal.
    - maxgashkov 2mo ago
      That's why it's very unlikely that you will be able to put a file under google.com/.well-known/acme-challenge But if you somehow managed to do that, no one in the right mind would argue that you're free to undelegate the domain or point it to a NS you control.

sandeepkd 2mo ago

To clarify, my observation is around how it might have happened, not if this is the right way to do it

sandeepkd 2mo ago

On a different note, adding a file on webserver is one of the ACME methods (HTTP-01) to get a SSL/TLS certificate so it is indeed considered as possession method in real world already

maxgashkov 2mo ago
You're missing that HTTP-01 challenge grants you no ability beyond what the check has demonstrated, i.e. you have proven that you're able to serve random file from a webserver, so the grant is to allow you to serve them via TLS connection. There are no comparable _technical_ proof-of-registration methods because all of them would require actual access to registrar control panel and be outright silly ('point the domain to a random nameserver'). So no, proper registrars never use webserver control as means to prove identity or ownership.
- sandeepkd 2mo ago
  > you have proven that you're able to serve random file from a webserver, so the grant is to allow you to serve them via TLS connection. Its digression from the original topic, still, it goes way far than that, these certificates are signed by a CA that the client devices trusts by the virtue of root certificates installed on the device. If I can some how obtain the SSL/TLS certificate for google then thats a very big deal.
  - maxgashkov 2mo ago
    That's why it's very unlikely that you will be able to put a file under google.com/.well-known/acme-challenge But if you somehow managed to do that, no one in the right mind would argue that you're free to undelegate the domain or point it to a NS you control.