Because corporate security has nothing to do with security, and everything to do with adding bureaucracy roadblocks to legitimate activity.
replyBecause web security has a lot of legacy crap. Such as cookies. Oh you added Domain=foo.com to your cookie? Now marketingvibecodedapp.foo.com can access the cookie from your main domain. What do you mean you thought adding the domain field restricts the cookie to just that domain? Lol no, it's the exact opposite, gotcha, dumbass.
replyBecause they point foo.example.com to AWS. They then let whatever the CNAME is pointing to lapse. Then an attacker registers the lapsed AWS and can now put their content on your trusted domain.
replyhttps://aws.amazon.com/blogs/security/threat-tactic-spotligh...
(AWS have since fixed this problem, but it exists on other services.)
deleted
replySo the solution is to make it even easier to let the domain records lapse by putting it outside the place where everyone would know about it, with the added bonus that now you can super easily let the domain registration itself lapse without noticing so that your customers who have been told to use it can get directly pwned by whoever grabs it?
replyWhich you could mitigate by using a Cert-Policy in DNS and HTST, so an attacker might not get s valid certificate for your domain and at least access is sonewhat restricted.
replyCounter-argument is: do you really want some team of 90% marketers and PMs throwing up a MVP/WIP codebase for some ancillary product not related to your core business on your core domain? At a minimum you'd want a thorough security review and risk assessment, and that goes against the ethos of "ship fast and pivot as needed".
replyWhy does the TLD matter in this case? How does your security/risk posture change if you launch on myexperiment.mycompany.com vs. www.mycompanyexperiment.website that you had to go out and newly purchase? Asking because I legit don't know.
replyOne example: a subdomain like experiment.example.com can access cookies for example.com.
replyI mean, it sounds like they're already doing that, just with extra downside
reply