16
[EURid registry] Is a 6 character lowercase alphanumeric password (31b entropy) which randomly changes every 2 hours safe enough for online service (possibly) without proper rate limiting? (lemmy.sdf.org)
submitted 1 week ago by to c/cybersecurity@sh.itjust.works
8 comments fedilink hide all child comments
 

I've recently registered a .eu domain name.

EURid registry has a portal where you can generate a transfer code, thus not fully relying on access to registrar (as well as check and verify your info).

Welp, security.

The only security is a code sent to e-mail associated with the domain. While the portal requires entering this address to log in, it can also be pulled from WHOIS where it is mandatorily published.
Regardless, e-mail (as a string) should not be affecting security.

The code, as I mentioned, is just lowercase letters and numbers. Precisely 6 of them. This is valid for 2 hours and one use.
While there is a "Request new code" button, I wasn't able to generate multiple codes for one 2 hour window, so that's good.

But now we get to rate-limiting. After 9 attempts, I get:

You have exceeded the allowed number of requests.
Please try again in 10 minutes.

Sounds good, BUT, clearing cookies bypasses this.
I have not (yet) tried any automation, I just quickly manually repeated this tomfoolery from same IP 3 times without actually being rate-limited.

I find this... at least strange. Especially since everyone is doing at least 2FA, while some sites even support physical security keys, and then there's "we email you 6 characters".

you are viewing a single comment's thread
view the rest of the comments
[–] 2 points 1 week ago*

I would have to imagine the system they have in place can not handle 302,330 requests/s even if you could issue them that quickly, but obviously that's not a security measure, just a practical limitation. There also may be other rate limits imposed which they do not advertise, but will kick in after 50 requests from any given IP address in a 5 minute period. I would assume if you could get away with trying 1,000 or 10,000 requests in a 2 hour period, that would be something you could demonstrate to them and have them listen. With what you've described now doesn't seem actionable, since performing 20 guesses is not the same as thousands to prove the exploit.

Also, I am not sure what regulations they need to follow as part of ICANN, but would imagine there is some documentation around what a registrar needs to adhere to for the security of transfer codes. This may be the minimum standards, and in that case, it would be on ICANN to update their guidance.

  • permalink
  • fedilink
  • source
  • parent