Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Does Your Domain Have a Registry Lock?

krebsonsecurity.com

Post reply on HN
Print view View original

61–70 of 73 posts

Re: Does Your Domain Have a Registry Lock?

#61

Post by newscracker »

xoa wrote: post #17
arkitaip wrote: post #10

Earlier quoted context omitted.

Probably because the manual management of these requests is relatively expensive.

Yeah, CloudFlare is one that offers it, but it seems firmly in "Request Quote/Call Sales" territory for pricing. It dates from when they first intro'd their original registrar offering [1] a few years ago, and they said right out: > "CloudFlare Registrar is not designed for the masses. There are plenty of great mass-market registrars. However, if you’re an organization where losing your domains would be a front-page…

Tangent: The mass market offering from Cloudflare does not have a way to buy/register a new domain. It’s been way too long since that offering was made public and it’s still stuck with just transferring domains from another registrar into Cloudflare.

Re: Does Your Domain Have a Registry Lock?

#62

Post by ta999999171 »

kube-system wrote: post #56
fierro wrote: post #33

Earlier quoted context omitted.

This does not seem like a sound philosophical security posture -- that only domains who are "massive targets for hacking" should use Registry Lock.

Security and usability is always a compromise. Otherwise we'd all use one-time pads for everything on the internet.

The public will soon find out that we should.

Re: Does Your Domain Have a Registry Lock?

#63

Post by 0xff00ffee »

eyegor wrote: post #52
0xff00ffee wrote: post #16

Earlier quoted context omitted.

AWS Route53 user chiming in here. I have IAM accounts and soft-token 2FA, and I like how minimal the R53 panel is. This makes me feel like I have a handle on things because there are so few paths to make changes. It also makes me worried I'm missing something. 7 years and no hacks (that I've detected). Knock on wood.

I'm guessing your domain wasn't a huge target then. There was a dns hijacking bug in r53 like 3-4 years ago that was fairly trivial to use. It allowed an arbitrary attacker to register new records to redirect your traffic and take a higher priority in the routing table. I probably shouldn't say much more about it because I don't think it was publicized after they fixed it.

I think you mean the BGP hack.

https://blog.thousandeyes.com/amazon-route-53-dns-and-bgp-hi...

That wasn't reaaaaly an AWS hack. BGP hacks are still an issue since it is mostly an honor system! There are no safeguards against this except fast admin.

Re: Does Your Domain Have a Registry Lock?

#64

Post by eyegor »

0xff00ffee wrote: post #63
eyegor wrote: post #52

Earlier quoted context omitted.

I'm guessing your domain wasn't a huge target then. There was a dns hijacking bug in r53 like 3-4 years ago that was fairly trivial to use. It allowed an arbitrary attacker to register new records to redirect your traffic and take a higher priority in the routing table. I probably shouldn't say much more about it because I don't think it was publicized after they fixed it.

I think you mean the BGP hack. https://blog.thousandeyes.com/amazon-route-53-dns-and-bgp-hi... That wasn't reaaaaly an AWS hack. BGP hacks are still an issue since it is mostly an honor system! There are no safeguards against this except fast admin.

Well, there was that too. What I was referring to was a specific issue that allowed you to add entries for domains in r53 which were already in use (in r53). I can't remember the specifics too well, but I think it was an api validation issue on one of the endpoints. It wasn't a "I own your domain now" so much as "I receive some of your traffic sometimes".

Re: Does Your Domain Have a Registry Lock?

#65

Post by speleding »

This is about a Dutch registrar being social engineered. I specifically chose a Dutch registrar for my Dutch company, thinking that it would be so much harder for non-Dutch people (99% of the world) to social engineer a Dutch registrar. I guess not.

Re: Does Your Domain Have a Registry Lock?

#67

Post by andreareina »

tialaramex wrote: post #44
fierro wrote: post #33

Earlier quoted context omitted.

This does not seem like a sound philosophical security posture -- that only domains who are "massive targets for hacking" should use Registry Lock.

Why? It's about threat models.

I would say because it's a small cost for the domain owner in return for protecting against what's potentially a pretty big emotional (and possibly reputational, financial) downside.

Re: Does Your Domain Have a Registry Lock?

#68

Post by clarry »

newscracker wrote: post #58
clarry wrote: post #40

Earlier quoted context omitted.

> that's easily removed by social engineering the registrar. I decided to eliminate that one by becoming my own registrar. And that's one less man in the middle siphoning money off of me.

Quite interesting. How did you do that and what did it take (cost, time, effort)? NearlyFreeSpeech.net started off on this a couple of years ago, and it seems like this is a very costly proposition (something like $80K for accreditation?) that also takes a lot of time.

The trick is to forgo ICANN scam and go with a ccTLD. With TRAFICOM (ex FICORA), it was a matter of filling a form. There could have been a small nominal fee but if there was, it must have been very low (under 100 eur).

Re: Does Your Domain Have a Registry Lock?

#69

Post by thiht »

clarry wrote: post #40
parliament32 wrote: post #6

The usual "registrar lock" is the clientTransferProhibited status you see on domains... that's easily removed by social engineering the registrar. "Registry lock" is serverTransferProhibited, the kind where both your registrar and the main registry need to agree to transfer the domain to another registrar. For instance, you can buy a .ca domain from any registrar, but you need CIRA's compliance (the issuing body for…

> that's easily removed by social engineering the registrar. I decided to eliminate that one by becoming my own registrar. And that's one less man in the middle siphoning money off of me.

How's that even possible? I cannot imagine how you could convince a registry to do this. Maybe a gTLD registry?

Re: Does Your Domain Have a Registry Lock?

#70

Post by clarry »

thiht wrote: post #69
clarry wrote: post #40

Earlier quoted context omitted.

> that's easily removed by social engineering the registrar. I decided to eliminate that one by becoming my own registrar. And that's one less man in the middle siphoning money off of me.

How's that even possible? I cannot imagine how you could convince a registry to do this. Maybe a gTLD registry?

https://www.traficom.fi/en/services/registration-registrar
Post reply on HN