alt Hacker NewsThe hijacker effectively established control over the domain. That's a properly issued cert in my book. There's no part of a domain control cert issuance where the CA is expected to establish the identity of the domain owner or obtain their consent.
The hijacker effectively established control over the domain. That's a properly issued cert in my book. There's no part of a domain control cert issuance where the CA is expected to establish the identity of the domain owner or obtain their consent.
That's not how it used to be, though. It used to be that you had to prove a much higher level of ownership, even for standard, non-"enhanced" certs. There was one time we discovered that the business hadn't had its articles of incorporation renewed in the state, and the validation process by the cert issuer caught it.
I do prefer the current model (the trade-offs are worth it, IMHO), but it wasn't always this way.