I'm working on a couple of projects that are along these lines:
- Domain Verification Protocol [1][2] – proving authority over a domain. This is an application of our broader technology (still in development) where the domain can represent any thing (not just a company, e.g. an asset).
- NUM [3][4] a way to store structured data in DNS so that the domain name is the unique key to make a telephone call, GPS locate, make a payment, etc
The usual response to concepts for storing anything in DNS is MITM attacks but these can be mitigated. See DNSSEC, DNS over HTTPs, DNS over TLS.
Email in my profile, you're welcome to reach out to discuss.
Admittedly I didn’t get that [1] far, thanks for pointing it out. I read the first half but he lost me at conversational dynamics (I mainly come here for the comments).
The battery analogy was a good way for me to understand my own experience and seemed like progress from the traditional definitions of introvert and extrovert.
Thanks for the heads up and I'm sorry about that, I can't seem to recreate it in Firefox at the moment but I'll get to the bottom of it. Are you in automatic/dark/light mode? Your Firefox version would be a big help too if you were happy to share that.
Thanks for the heads up, home page or any page in particular?
It’s ok for me but I’ll check the logs.
It’s just a basic fly.io setup at the moment but it should be more than capable of dealing with the traffic - just html (and htmx) front end and Sinatra back end.
Oh and to prevent what happened last time (the post getting flagged as an overheated discussion), I'm going to close the laptop and come back to this in a few hours! So if you ask a question, I'm not ignoring you – I'll respond later.
Thanks for this really interesting feedback – especially that the subdomain method could create more opportunities for cache poisoning.
Interested to explore how a cache poisoning attack might be easier on a Domain Verification protocol TXT record compared to a DNS-01 TXT record.
Given the scenario: an attacker is attempting to claim a domain (example.com) with service provider (SP1) who uses a DNS revolver (DR1) I don’t immediately see how the subdomain approach makes a cache poisoning attack easier.
Couldn’t the attacker similarly keep asking DR1 for <rand>._acme-challenge.example.com and spam back NS delegation answers for _acme-challenge.example.com, with the goal that upon cache poisoning success, they could fraudulently claim example.com with SP1?
I may have overlooked something here, if so please explain.
With either method, DNSSEC would definitely seem the solution as you’ve suggested.
If I understand correctly, let’s say a popular CDN was no longer maintained and the domain expired, eg popularcdn.com - you’re looking for a way to use a dns record lookup to verify that the domain (and cdn) is still controlled by who you think it is?
I guess for scripts this can be dealt with using integrity hashes but that’s version specific. So this would be a security check at a domain level?
I guess the hard part would be that any CDN hijacker could copy the DNS TXT record when they hijack it.
That’s correct, we have a couple of projects that use DNS TXT for storing data and JSON and TXT records are not a good fit. My description above references compactdata, which as you pointed out is the new name for MODL which uses to live at https://www.MODL.uk
WHOIS is largely useless now because of Privacy Protection Services, Proxy Registrants and GDPR. The WHOIS protocol itself is more or less entirely shut down in favour of RDAP [1].
- Domain Verification Protocol [1][2] – proving authority over a domain. This is an application of our broader technology (still in development) where the domain can represent any thing (not just a company, e.g. an asset).
- NUM [3][4] a way to store structured data in DNS so that the domain name is the unique key to make a telephone call, GPS locate, make a payment, etc
The usual response to concepts for storing anything in DNS is MITM attacks but these can be mitigated. See DNSSEC, DNS over HTTPs, DNS over TLS.
Email in my profile, you're welcome to reach out to discuss.
1. https://www.domainverification.org
2. https://news.ycombinator.com/item?id=35827952
3. https://www.num.uk
4. https://www.numprotocol.com