1

For context, I have limited knowledge pertaining to computer networks, and the recent seizure of z-library brought up some questions I am unsure of, and I can't seem to find much information online.

From my current understanding:
When you try to access a site using a domain name, the client sends a DNS request to a DNS server which returns the IP address corresponding to the domain name. The client then proceeds to use the IP address to contact the server directly. For example, inputting https://142.251.32.78/ in my browser leads me to google.com. I am assuming that by providing the IP address directly, the client skips contacting the DNS server?

Then, from what I can find online, a domain seizure simply entails the US government seizing a domain name so that the original server can no longer be accessed using that domain name. If that's all, then:

  1. What stops the server from using a different domain name?
  2. What stops one from accessing their server directly using IP address like in the example above for google?

I'm assuming for some reason that the second point doesn't work as it looks like people are resorting to using tor, but I can't find an explanation as to why.

3
  • 1
    "Nothing" for both, except that using IP addresses in HTTPS URLs is not convenient because you either have to accept no valid certificate (which most browsers won't be happy with) or you have to make sure to generate proper certificate with IP, which is possible, but more difficult so either you find a CA offering that or you do your own, which won't be accepted then as trusted by browsers because not from a known CA. And then you have to redo it each time you change your IP address. Which is why a domain name is handy as a stable reference :-) Nov 8, 2022 at 4:31
  • @PatrickMevzek This should be posted as an answer.
    – Marcel
    Nov 8, 2022 at 8:42
  • In addition to the answers already given a 3rd question might be, "What about and ONION address?" z-Library does in fact have an onion adress. Nov 8, 2022 at 19:21

1 Answer 1

1

What stops the server from using a different domain name?

In general, nothing. It's possible in the case of a court order that the domain registrars would be under an order to not allow the site owner to register a new domain, and it does cost some money in any case, but in general it's a simple business transaction (you have to provide some personal information but not a lot). Then, once the new domain name is published, you point it at the server; setting up the DNS records can take some effort (especially if you want to e.g. use email with the domain name directly) but it's not hard. If you want to serve TLS traffic (typically HTTPS) for the domain, you'll need a TLS certificate and want to get it from a trusted certificate authority; setting that up can be a little effort but not terribly much (and these days it's possible for free).

It might take a little while before the new DNS entry is available everywhere, but probably only minutes. It might take a bit longer before the site is indexed under the new name by search engines, but still probably only hours.

What stops one from accessing their server directly using IP address like in the example above for google?

Possibly nothing, but in practice people don't usually go for it.

  1. IP addresses are hard to remember, annoying to type, and unfamiliar to most people. This is one of the primary motivators behind the domain name system, after all.
  2. When making an HTTPS connection (such as TLS), the client (browser) will expect the server's name (in the URL bar) to match the name given in the certificate. If using an IP, they won't match; no public CA will issue a certificate for an IP address. This will, at minimum, cause a scary-looking browser security warning. It also prevents using some advanced security measures, such as HTTP Strict Transport Security.
  3. Depending on how the site is hosted, it might be impossible to reach it by IP alone. Many sites are co-hosted on a shared IP address, and the browser tells the server which one it wants via domain name. Google doesn't have this problem, of course; they outright own a large chunk of IP addresses, and assume anybody connecting to one of them is trying to reach Google. But smaller sites, and those with minimal budgets, may require the browser to identify the site it is trying to reach by name, either using SNI (for HTTPS) or just in the Host: HTTP request header (for plain-text, or after the TLS connection is established).

Finally, it's worth considering that the site might not still be online to connect to. It depends on the details of the court order, how it was executed, where the site was hosted, and more, but in theory the courts can order a hosting company to take down a server / block a customer's account, or an ISP to cut off a customer (which would prevent even hosting on your own hardware, at least until you got a different ISP). I don't know if any of that applies here, but generally speaking, unless the order is specific to the domain name rather then the site (e.g. because it's subject to a trademark dispute or was illegally seized)

3
  • "no public CA will issue a certificate for an IP address" That is not true, see for example the certificate on 1.1.1.1. IPs in SAN are completely specified and authorized by CABForum guidelines. I think Lets Encrypt did also say they will support them in the future. Nov 8, 2022 at 15:40
  • @PatrickMevzek Interesting! I knew it was possible - I've seen it done with internal CAs before - but wasn't aware of it "in the wild". With that said, 1.1.1.1 (and Cloudflare in general) is something of an outlier. Obviously a public CA isn't going to issue a cert for an IP from a private range, but are you saying that certs for arbitrary publicly-routable IP addresses are or may soon be available? That's fascinating if true.
    – CBHacking
    Nov 9, 2022 at 7:29
  • "Obviously a public CA isn't going to issue a cert for an IP from a private range" That is something else. 1.1.1.1 is not private range, and the website has a certificate on that IP address by a public CA. "but are you saying that certs for arbitrary publicly-routable IP addresses are or may soon be available?" They are available since a long time. See "3.2.2.5 Authentication for an IP Address" in github.com/cabforum/servercert/blob/main/docs/BR.md . It still probably in most cases not a good idea for HTTPS URLs, but like in RPKI world IPs in certificates are the basis. Nov 9, 2022 at 13:25

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .