Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

TXT Record XSS

who.is

Post reply on HN
Print view View original

51–60 of 236 posts

Re: TXT Record XSS

#52

Post by UweSchmidt »

TallboyOne wrote: post #46
xenophonf wrote: post #14

Earlier quoted context omitted.

Stuff like this is why NoScript and RequestPolicy were invented.

For making your life living hell in the name of overbearing security measures.

Ah yes. The occasional click to confirm this or whitelist that, that's definitively "living hell".

It's the users' resistance to the slightest inconvenience that makes security so hard.

Re: TXT Record XSS

#53

Post by iLoch »

bwy wrote: post #35

Wish there was a warning, because I accidentally clicked this link in class just now.

Don't browse with your volume turned up? How do you assume you wont be interacting with any pages that may produce noise?

Re: TXT Record XSS

#54

Post by pshinghal »

__david__ wrote: post #26
r0m4n0 wrote: post #16

isn't this technically illegal to demonstrate haha?

Why on earth would it be illegal?

I don't think it makes any sense for this to be illegal, but I can point to at least one example where sense didn't necessarily dictate "justice": http://www.ehackingnews.com/2013/12/anonymous-hacker-charged...

Re: TXT Record XSS

#55

Post by tokenizerrr »

r0m4n0 wrote: post #32
__david__ wrote: post #26

Earlier quoted context omitted.

Why on earth would it be illegal?

dam, that got downvoted into oblivion haha. honest question... although i dont believe it should be, a third party injecting javascript to demonstrate an exploit might be...

So do you want to make it illegal to set the contents of your own domain's TXT record to:

""

Because that is all this is.

Re: TXT Record XSS

#56

Post by SEJeff »

JamieH wrote: post #30
pkinsky wrote: post #28

Earlier quoted context omitted.

This is hilarious, but what's up with this line? >jamiehankins.co.uk descriptive text "v=spf1 include:spf.mandrillapp.com ?all" Why is mandrillapp.com (tranactional email startup) included?

It's my personal domain, I use mandrill for some stuff.

Hell of a good prank dude, well played sir!

Re: TXT Record XSS

#57

Post by mrb »

I am half serious, but how about making HTML served in TXT records a standard trick for serving small web pages very quickly? There are way fewer network round trips:

  1. DNS query for TXT record for example.com
  2. DNS reply with HTML content
Compared with the traditional 7 steps:

  1. DNS query for A record for example.com
  2. DNS reply with x.x.x.x
  3. TCP SYN to port 80
  4. TCP SYN/ACK
  5. TCP ACK
  6. HTTP GET
  7. HTTP reply with HTML content
It would also make the content super-distributed, super-reliable, as DNS servers cache it worldwide (and for free so it would reduce hosting costs :D). Also TXT records can contain more than 255 bytes as long as they are split on multiple strings of 255 bytes in a DNS reply.

Again, I am only half serious, but this is an interesting thought experiment...

Edit: oddtarball: DNSSEC would solve spoofing. And updates should take no longer than the DNS TTL to propagate: the TTL is under your control; you could set it to 60 seconds if you wanted. It is a common, false misconception that many DNS resolvers ignore the TTL. Some large web provider (was it Amazon? I forget) ran an experiment and demonstrated that across tens or hundreds of thousands of clients wordlwide, 99% of them saw DNS updates propagated within X seconds if the TTL was set to X seconds. Only <1% of DNS resolvers were ignoring it.

Re: TXT Record XSS

#60

Post by wittrock »

_RPM wrote: post #58

When I went to the page, it started playing music. I find that very frustrating and annoying.

That's the point--who.is won't play music by itself. Its lookup of the DNS records of jaimehawkins.co.uk injected the music into the page.
Post reply on HN