> The only reason they couldn't fully steal DNS settings was I had 2FA enabled with my registrars and on my email account
This sounds like they had your password?
Re:Stay Away from Cloudflare (2017)
by crummybowley on Thursday June 17, 2021 @03:29PM
(#27543581)
Also seems like CF jumped the gun on letting their servers serve content to their own servers -- seems like CF fucked up too.
Like, when you are CF big you can't just start resolving domains however you feel because folks use your DNS service.
If their 8.8.8.8 resolver was returning results from customer accounts that weren't verified, like the GP seems to imply, that seems like a huge security problem.
1.1.1.1 ... 8.8.8.8 is google :)
but ... but ... but!
free markets!
/s
Re:Stay Away from Cloudflare (2017)
by crummybowley on Tuesday June 29, 2021 @02:59PM
(#27680224)
This is not a free market issue. Free market does not mean companies can do what they want.
Hence the "/s" :)
Nope - they didn't change anything with the registrars
But Cloudflare still let them start making DNS entries
Wow, that's a lot of bad. How did they manage to create an account with your email address? Doesn't it require verification?
You'd think, right?
Cloudflare (at least at the time) would let you create an account and start doing stuff without verifying you actually owned the email address
Fat-finger? bob[at]bob[dot]com to bon[dot]com? No worries
Enter my email instead of yours? Go for it
It's just a login...right?
Cloudflare ended up getting listed as authoritative DNS in its own DNS resolver (even though the registrar's records were supposed to be authoritative)
The only reason they couldn't fully steal DNS settings was I had 2FA enabled with my registrars and on my email account
Took nearly 3 days to claim the malicious Cloudflare account via password resets to my actual email address and enable 2FA on it to my authentication tools
Took another week+ to delete all attempted DNS registries and get Cloudflare to not recognize themselves as authoritative DNS resolution for the domains
And over a month for tech "support" and "legal" to finally get around to responding to my complaints basically saying, "you should have created an account with us with that email so no one else could try to steal it"