I think having multiple authoritative DNS servers in different networks might help with this.
I'm not sure how CAs deal with situations when a domain has several authoritative DNS servers, but not all of them respond with expected reply. Would it would be a good idea for CAs to ask *all* authoritative DNS servers and require a coherent answer from them?
> I think having multiple authoritative DNS servers in different networks might help with this.
For the case of the dns-01 challenge type, sure. But if you're using http-01 (or the attacker asks for it), then all those DNS servers will answer back with the same IP address for the A(AAA) query and you're back to the hijacking scenario.
The attacker could hijack the network and initiate the ACME protocol against the CA in the CAA field. There is a draft for dns-account-01 which allows one to specify an ACME account which is authorized for updates (which uses the account key (and not cert key)):
haven't heard about dns-account-01, thanks! Heard only about dns-persist-01.
I meant to say that CAA record can also specify account, or at least Let’s Encrypt docs mention it[1]. So unless attacker has access to victim's account - they can't get a cert (unless they can hijack dns, too).
The point is to prove you control a domain. If you are answering traffic to requests from clients at that domain, you control it. Whether you're supposed to have control over it is outside the scope of this validation
If you're answering traffic then it means some service has been delegated to you. And if you were delegated https I think it's fine to give you an https certificate.
But that's not controlling "the domain" in my book. You control the domain if you control the nameserver.
Agreed. On the other hand, these DV certificates only claim to verify who _controls_ the domain. Probably, you can agree that hosting provider and government can also control the domain, no? :)
Moreover, with dns-01, DNS provider can issue fake certificates - unless you self-host DNS - in which case, only your DNS registrar can... and a government.
> Moreover, with dns-01, DNS provider can issue fake certificates - unless you self-host DNS - in which case, only your DNS registrar can... and a government.
Which is what DNSSEC is supposed to help with: the registrar/government would have to replace your DS/KSK with their own. Without DNSSEC queries/replies could potentially be altered over the wire (or you're in a race condition as to whether the real or attacker's reply get back first).
I've seen few places accepting only cash or cards from a local payment processor. And it looks like local payment processor takes about 0.16% from each transaction.
So I assume that if they were accepting more expensive cards, they might've increase the price of the $100.16 product for me, to offset their costs.
And yes, I also heard that payment processors have rules that require merchants to have the same price no matter what payment processor (or cash) customer will choose.
I have a few scripts that interact with wl-copy. Like one that just cats all the files in a directory and pipes it into wl-copy so I can paste it somewhere else. Something like that would've been immensly useful when I was still on windows, but that would've been too much a bother to set up.
I'm not sure how CAs deal with situations when a domain has several authoritative DNS servers, but not all of them respond with expected reply. Would it would be a good idea for CAs to ask *all* authoritative DNS servers and require a coherent answer from them?