Re: [dane] domain hijacking

[Wei Chuang <[e-mail]>]

On Wed, Apr 12, 2017 at 8:11 PM, John Levine <[e-mail]> wrote:

> > If my suspicion is correct, has there
> >been thought of re-signing the DS record signed with the older private key
> >in a way that proves ownership through the key change?
>
> This sounds to me like shutting the barn door after the horse is gone.
>
> If it's important to you that your domain isn't hijacked, we all know
> what to do, pick a registrar with good security and 2FA and so forth,

and monitor your own DNS with alarms if there are unauthorized changes.
>

Even with a good registrar there might be some reason for this.  Consider
that 2FA might not  be a permanent solution to zone admin account
hijacking.  For example, RSA 2FA products which are very popular, were
reportedly bypassed back in 2012
<https://arstechnica.com/security/2012/05/rsa-securid-software-token-cloning-attack/>.
Further such a solution might better detect/prevent spoofing by a
adversarial parent zone or registrar.  Agreed that monitoring is a good
idea.  One issue it that it may be difficult for you/your script to be
always vigilant.  Perhaps by making a domain hijacking more visible to
everyone, and having a whistleblowing (i.e. reporting mechanism such as
used in Coniks) protocol then you could distribute the problem of
monitoring.


>
> Also, if we were to invent some sort of change signing, now you have
> the other problem where the guy with the private key quits and takes
> it with him, and you have to rebootstrap the zone somehow.
>

Agreed this is pertinent issue and I don't have a fully baked scheme to
work out this scenario.  But perhaps a solution might involve checking the
cached but stale result to see if that historic state is consistent with a
newly published state up to 1 TTL period.  Errors condition would then
existing for a finite time (1 TTL).

-Wei