Re:Universal DNSSEC: Secure DNS for Every Domain
by ynik on Tuesday November 10, 2015 @03:42PM
(#10542331)
> Fundamentally, if you control a domain you can get a CA-signed certificate for any label under it.
It's worse than that. All an attacker needs to do is passively monitor the target domain's emails, and he can get a valid CA-signed certificate. If the attacker can only monitor some networks, not all globally: no problem, since the attacker gets to choose which CA the email gets sent from!
It's worse than that. All an attacker needs to do is passively monitor the target domain's emails, and he can get a valid CA-signed certificate. If the attacker can only monitor some networks, not all globally: no problem, since the attacker gets to choose which CA the email gets sent from!