[sandeepkd]

In the absence of actual details its hard to say what was considered for making this decision. If I have to take a wild guess then being able to demonstrate the control on the webserver hosting the content could have been one way to prove ownership over the domain.

It can be called social engineering, however one can also put it in category of account recovery by verifying content control on the domain.

The part where it gets hairy is if your credit card was associated with the account, thats probably a recipe for disaster?

[maxgashkov]

Webserver control is never used and must not be used to prove domain ownership. If you're pwned and have to re-point to a server stood up from backup, having registrar relying on someone being able to put up a random file on a compromised machine would be a total security disaster.

[sandeepkd]

On a different note, adding a file on webserver is one of the ACME methods (HTTP-01) to get a SSL/TLS certificate so it is indeed considered as possession method in real world already

[maxgashkov]

You're missing that HTTP-01 challenge grants you no ability beyond what the check has demonstrated, i.e. you have proven that you're able to serve random file from a webserver, so the grant is to allow you to serve them via TLS connection.

There are no comparable _technical_ proof-of-registration methods because all of them would require actual access to registrar control panel and be outright silly ('point the domain to a random nameserver').

So no, proper registrars never use webserver control as means to prove identity or ownership.

[sandeepkd]

> you have proven that you're able to serve random file from a webserver, so the grant is to allow you to serve them via TLS connection.

Its digression from the original topic, still, it goes way far than that, these certificates are signed by a CA that the client devices trusts by the virtue of root certificates installed on the device. If I can some how obtain the SSL/TLS certificate for google then thats a very big deal.

[maxgashkov]

That's why it's very unlikely that you will be able to put a file under google.com/.well-known/acme-challenge

But if you somehow managed to do that, no one in the right mind would argue that you're free to undelegate the domain or point it to a NS you control.

[sandeepkd]

To clarify, my observation is around how it might have happened, not if this is the right way to do it