Hacker News Reader

So how does it actually work? The article is so poorly written I don’t understand the exact mechanism that would allow this

View on HN

Quite simple really. Imagine you buy a domain (e.g. foo.com) and park it on some popular registrar. Many of those create a few "CNAME" DNS records like ftp.foo.com, mail.foo.com, etc. by default. Then you decide to use Shopify with this domain you bought, so you modify its "A" DNS record to point to Shopify's IP address. Boom, you're now susceptible to this "attack" -- >anyone< can go ahead and register a Shopify account and attach one of your dangling subdomains to it!

But why would shopify ever treat a subdomain as an entirely separate store outside of the main domain? That makes no sense.

If i register xyz.example.com as my store, then that should just be in my ONE account which verifies example.com, then by adding a second store, i can only add it as a subdomain from that main account, not just an entirely separate account.

Or, lets say its a separate account, then it should make me add records from that NEW account, even if there are already existing records.

So i still dont understand how this is possible

Yes, that makes no sense, but that's how it is, because Shopify allows it. My friend's subdomain got taken over like that just a couple weeks ago.

Reply on news.ycombinator.com