One possible issue is that IPs are re-used in cloud environments. Potentially, y...

mej10 · on Oct 21, 2016

Yeah, that is definitely possible.

I mean, hopefully it is over HTTPS so they can't do anything with it... but if it isn't then it can definitely happen. Our servers get random web traffic all of the time.

bhauer · on Oct 21, 2016

True. I am not aware of any web services POSTing sensitive data over the public Internet that don't use HTTPS. If your service is sending sensitive data over HTTP without TLS, I feel the problem is bigger than a potential long-lived DNS resolution.

leesalminen · on Oct 21, 2016

Valid point! One would hope that does not happen.

icebraining · on Oct 22, 2016

I mean, hopefully it is over HTTPS so they can't do anything with it...

DV certs only rely on you being able to reply to an HTTP request, so if any CA was using such a caching DNS server, you could probably get a valid cert from them.

woot01 · on Oct 21, 2016

HTTPS does not protect you against sending data to a host owned by another company.

aianus · on Oct 21, 2016

Yes it does, the cert presented by api.othercompany.com would not pass validation when you're trying to open a connection to api.intendedcompany.com.

leesalminen · on Oct 21, 2016

Correct, but they wouldn't be able to decrypt the data.

icebraining · on Oct 22, 2016

The data doesn't even get there, the handshake kills the connection before that.