Post #162289

2026-01-28 10:39 UTC

RE: https://infosec.exchange/@SecurityWriter/115969540425890734 To build on what was said below, your whole online existence is essentially three things combined: 1 - Your email account or mail server where you can get password resets. 2 - DNS that protects the mail server from being impersonated. 3 - Your domain WWW server that can publish records that your domain registrar or certificate authority trusts when issuing certificates. If you lose control of your email account or mail server, people can password reset their way into all of your account unless you have some strong second factor as a security key. If you have a secondary email recovery account that would be vulnerable. It could possibly be used to bypass your second factor. If you lose control of your DNS server or your registrar account, then people can impersonate your services such as your web server or mail server for account recovery. A DNS attack could completely remove your existing servers and point traffic to malicious ones as well. Finally if you lose control of you web server then it could be used to publish .well-known files used for identity verification with certificate authorities, spread malicious files, your imagination is the limit. As you can see DNS and email are critical. Today everybody outsources their DNS and email. Choose how you manage these as if your identity, finances, and company depend on them. Basically no one controls their own identities. By running your own email or DNS servers the third-party doctrine would not apply to you, and you would get notice that something was going on with law enforcement.

Replies (9)

@hc@mastodon.africa 2026-01-28 13:13

@thedarktangent@defcon.social I got a pretty good offer for my main domain recently and thought it would be nice if I could accept it but feared that someone was after my linked accounts as my entire life is connected to it. I told my wife she needs to make sure she renews the domain if I die. This is not robust at all. What is one to do and who should one have the domain with?

Open ##2855081
@tomgag@infosec.exchange 2026-01-28 14:42

@thedarktangent@defcon.social it is becoming increasingly clear how critical this observation is. Considering Zooko's triangle ( https://en.wikipedia.org/wiki/Zooko%27s_triangle ), I am getting more and more convinced that anything that does not rely on a cryptographic identity is a waste of time in the long run. Yes, even Mastodon. DNS -> Namecoin Mastodon -> Nostr Signal -> Jami/Briar/SimpleX/Etc Yes, I know that many of these alternatives carry a questionable philosophical/cultural background. But, from the technological point of view, they are probably the way to go.

Open ##2855082
@betabug@mastodon.sdf.org 2026-01-28 15:08

@thedarktangent@defcon.social 10 years ago "my" bank's internet banking was set up so that for a password reset you needed an ID document and had to go to the bank branch in person. I liked that. Then ofcoz they decided that this is inconvenient. Now resetting the password is all of a few clicks and a mail away. Because what could possibly go wrong.

Open ##2855085
@harrysintonen@infosec.exchange 2026-01-28 17:01

@thedarktangent@defcon.social This, among some other factors, is the reason my I've self-hosted for a long time now. https://infosec.exchange/@harrysintonen/115916299816297773

Open ##2855086
@GerardThornley@hachyderm.io 2026-01-28 18:02

@thedarktangent@defcon.social I've run my own of these in the past, but don't anymore. I think it's worth considering the risks: A) you can run your own, but need to stay on top of things at all times. That means installing security patches as soon as they're available, but also checking your configuration remains appropriate across updates, and keeping up with relevant reports. or: B) you can outsource to a third party, but you better be sure they're trustworthy. That means trusting them to do all the work of A, as well as relying on them to not work with 'other third parties that don't have your best interests in mind'. For me, as well as for many other technically able people, the work of A is not our day job and becomes too onerous to sustain (which is the crucial part), so B becomes necessary, despite the highlighted risks.

Open ##2855095
@fazalmajid@social.vivaldi.net 2026-01-28 18:58

@thedarktangent@defcon.social if your registrar is in the US, you are still vulnerable to take-downs like happened to Steve Marshall: https://www.npr.org/2008/03/11/88091563/online-travel-not-so-libre-for-cuba-fans

Open ##2855096
@RupertReynolds@hachyderm.io 2026-01-28 20:29

@thedarktangent@defcon.social Also consider recent advice to put all your passwords (eggs) in one basket--password managers. Suspiciously, I trusted a few harmless passwords to Bitwarden. It worked fine for a year or so, then "An error has occurred. (waffle). Please try again, or contact us" Harrumph!

Open ##2855097
@paco@infosec.exchange 2026-01-29 01:03

@thedarktangent@defcon.social I thought it would be really neat to crowd-source a graph database of this stuff. Nodes would be services (gmail, iCloud, your own mail server), edges would be attack vectors (password reset, social engineer support, brute force something, etc). Any person could select the nodes that are important in their life and then run analyses. E.g. my main email is yahoo.com, my web site is blah, my registrar is blah. Edges have various attributes like cost in time, cost in money, noise level/detectability, etc. Then, using some kind of path/graph logic, an individual (or business) can chart the shortest (or easiest, or cheapest) path from a starting point to an end point. If I compromise a domain registrar for example.net, how many steps am I from getting access to bob@example.net’s google drive? The idea behind crowdsourcing is to capture attributes of the various services: password recovery for this mobile phone provider is SMS and birthdate. Password recovery for this bank is a recent statement amount and last 4 of the account number. People would enter (and the system would somehow store) what they knew for various service providers so that over time we build and maintain all the nodes, Wikipedia style. And then anyone who also uses a certain provider benefits from the data in their graph. Events like the recent bitlocker key disclosure revelation from Microsoft change the graph. Suddenly there is a path to something where previously we didn’t have one in the graph. A provider switching from TOTP to passkeys would change its properties and, thus, a bunch of graphs and paths. I just don’t have the brains or the time to implement it. But it seems fun.

Open ##2855099
@nik@toot.teckids.org 2026-02-05 09:10

@thedarktangent@defcon.social > Today everybody outsources their DNS and email This claim is provably wrong.

Open ##2855100