DNS renewal attack(?)

[Ekleog]

Hello,

This was in my mind implied by matrix-org/matrix-spec#275, but it is not explicit there, so singling out this particular issue here. This is basically a question, and a hint for future spec development: what if a server admin forgets renewing a DNS domain, and an attacker grabs it?

The potential attacks could include:

• Reading the history of private rooms of users of the attacked server, by asking federated servers to give it over
• Getting future messages of still-joined private rooms, thanks to now owning the DNS

[ara4n]

Yup.

https://github.com/matrix-org/matrix-doc/issues/831 is the main github issue here.
https://github.com/matrix-org/matrix-doc/issues/619 is a related issue about certificate pinning.
See also matrix-org/synapse#2806

This would be fixed by the https://docs.google.com/document/d/1ni4LnC_vafX4h4K4sYNpmccS7QeHEFpAcYcbLS-J21Q/edit#heading=h.8qfidi5t91ba proposal.

[ara4n]

(closing this as a dup of https://github.com/matrix-org/matrix-doc/issues/831)