14

Windows Live recently suffered a security incident because they didn't realize that email addresses like administrator@live.fi are considered "trusted": some certificate authorities will consider anyone can controls that email address to be the owner of the domain live.fi.

How do I obtain a list of email addresses that are considered "trusted"? Or, in other words, if I want to allow untrusted users to obtain email addresses at my domain, which email addresses do I need to prevent them from obtaining? Where do I get a list of all of those special email addresses that might be trusted by someone? Of course, there are many certificate authorities, so at a minimum, this list would need to include the union of everything that is trusted by any certificate authority anywhere.

I know RFC 2142 lists some reserved email addresses, but it looks like this is not enough: some certificate authorities trust additional email addresses that are not on this list.


Related but not the same: While searching the Internet for lists of reserved usernames and lists of usernames to block, I found the following additional resources: Is there a list of common usernames to reserve in a new system?, shouldbee's list, kwappa's list.

  • 2
    Unfortunately I don't think there's a canonical all-encompassing list - RFC2142 is where I'd have started too. You'd have to ask the major CAs and cross your fingers. Yet another fun facet of PKI. – Polynomial Mar 19 '15 at 16:36
  • People are going to try this with many domains. xs4all.nl was also affected, which was kind of surprising as they are known for their knowledgeability and fight for privacy rights. tweakers.net/nieuws/102024/… – Jeroen Wiert Pluimers Mar 21 '15 at 18:05
9

It's a rather short list: ‘admin’, ‘administrator’, ‘webmaster’, ‘hostmaster’, or ‘postmaster’

Now that's the fixed and static list. But: contact info from WHOIS is also legal.

From the CAB-Forums' Baseline requirements, page 17:

11.1.1 Authorization by Domain Name Registrant
For each Fully-Qualified Domain Name listed in a Certificate, the CA SHALL confirm that, as of the date the Certificate was issued, the Applicant (or the Applicant’s Parent Company, Subsidiary Company, or Affiliate, collectively referred to as “Applicant” for the purposes of this section) either is the Domain Name Registrant or has control over the FQDN by: [...]

  1. Communicating directly with the Domain Name Registrant using the contact information listed in the WHOIS record’s “registrant”, “technical”, or “administrative” field;

  2. Communicating with the Domain’s administrator using an email address created by pre-pending ‘admin’, ‘administrator’, ‘webmaster’, ‘hostmaster’, or ‘postmaster’ in the local part, followed by the at-sign (“@”), followed by the Domain Name, which may be formed by pruning zero or more components from the requested FQDN;

Edit 2015-03-21: Entrust blog. Here's a nice blog entry with some backstory.
Bruce Morton, Entrust Identity ON Blog, 2015-03-20, What Happened with Live.fi? (Archived here.)

Interesting quote here:

The attack we are talking about has been performed before in 2009. It was done to the RapidSSL CA where they provided fourteen email addresses for the subscriber to choose from. In this case the attack was also done against another Microsoft domain login.live.com where the subscriber registered sslcertificate@live.com, then requested the certificate using the email address they controlled. This created a security furor to limit the email addresses.

Edit 2015-03-24: WHOIS The "Baseline Requirements" also allow E-mail addresses from WHOIS records. I have updated this above.

1

Comodo, which was involved in this fiasco, trusts the following email addresses for domain verification:

  • admin@
  • administrator@
  • postmaster@
  • hostmaster@
  • webmaster@
0

In practice, the ability to respond to email sent to any email address proves nothing at all, not even that you own the email address in question. All email is subject to tampering by the people who actually control the mail servers it passes through.

If I have root access to domain foo.com, I have absolute control over all the email delivered there or originating there. Likewise, if I were a low level geek working for gmail, I could probably implement a tidy scam based on siphoning gmail accounts, were it not for Google's foolproof internal security.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.