Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

I don’t quite follow why a missing underscore results in a security problem. It seems like it must be somehow related to what’s valid for CNAME records?


For DNS managers, it’s a known thing to restrict the use of domains that start with _. It’s effectively a reserved keyword.

In this case, a sophisticated attacker can get certificates for domains they don’t control by abusing this.


Thanks, that’s helpful information.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: