1

The DNS resolving process ultimately relies on root servers located in the USA for most extensions (.com and .org root servers for example). Even if the IP addresses of these servers are cached by local DNS resolvers in my country, relying on domain name and root servers is sort of a single point of failure, and bring well known weaknesses (DNS hack, DNS poisonning etc...).

Let's say I have strong confidence in the ISP that allocated an IP address to my house/workplace, or even that I own this IP address, I know I'll always be reachable at this IP address, and I have registered for a SSL certificate for this domain.

Considering this (that you can trust IP address and certificate), is it more safe to rely solely on IP address (over SSL) to host a web service, and therefore do not register for any domain name?

2

DNS can be a point of attack, yes. DNS exists because remembering something like 198.51.100.36 is significantly harder to remember than Lamouette.com. If you want to give it a go, more power to ya but I'd caution that if it's a public web presence you're after, your visitors will not appreciate having to use your IP address over your domain name.

And if you cut your SSL cert with the IP address but you publicize your domain name for use, your users will get ugly messages from modern browsers claiming that the details of the SSL certificate (based on IP) do no match the value your visitors are using: Lamouette.com.

So while it technically is more secure, it's functionally unusuable for an internet presence. More power to ya though if you decide to try and buck the system.

  • 1
    Never mind IPv4. Try something like 2001:db8:c94c:dad6:7e8d:31db:8b17:7c2b on for size. – a CVn Dec 19 '18 at 7:37
  • Yes thanks for your answer, I was thinking of some professionnal web services / api (not visible to the user), not necessarly public site like sony.com for normal users. – Lamouette Dec 19 '18 at 16:16
0

which is why https://1.1.1.1 exist (just a proof of concept that SSL certs also work on IP addresses)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.