Hacker News Reader

Comment by uxp8u61q | Hacker News Reader

Are you aware of how letsencrypt operates, for example? With a single spoofed dns record, you can get an https certificate. A whole lot of infrastructure relies on DNS for security.

View on HN

There is a difference between spoofing a record for a specific DNS server and spoofing a global DNS request.

Maybe, but the top thread just said "the validity of a DNS record".

You need to spoof at least three records (for the same domain) to get a certificate.

…no? Or what are the other two records? If I can control example.com, I can use an http-01 challenge to obtain a cert for example.com.

I can't do a dns-01 challenge (that would require _acme-challenge records, although even then, I'm still up to 2, not 3, records), but I don't have to do a necessarily have to do a dns-01 just to get a cert…

If you can control example.com actually on the root NS you should get the cert for example.com! That's not spoofing, that's owning.

If you can control the record seen in one datacenter for example.com, you don't get the cert. They check the root NSs from three DCs.

To be fair these days you need to spoof it in at least two locations around the world - they will query you from at least two locations. But yeah, it is bootstrapping security out of seemingly nowhere.

Even in the dns-01 case you only need the one _acme-challenge record to *get* the cert. You only need more records to be able to do something meaningful with your cert, eg A/AAAA records that point to your malicious server and serve that cert.

Best practice is to use CAA records, which would help reduce the impact unless the CAA specifies letsencrypt.

It’s a terrible practice designed to build a moat for billion-dollar corporations feeling scared of free Let’s Encrypt certificates turning off the money printer.

My domain has a caa of letsencrypt, how is that a moat?

Please google "CAA DNS record"

It's beyond me how letsencrypt hasn't been shitlisted, yet.

Why? What's your preferred alternative and why is it more secure?

I don’t have insider knowledge but I feel like a good portion of digicert engineers are basically window-lickers based on some of my insights.

Reply on news.ycombinator.com