Comment

Comment by rolfvandekrol

If I understand correctly, you need to submit the verifiable identifiers (email address and optional salt) to the party where you need to verify. That means you need to trust said party to not abuse this information to verify your domain with other services which use the same verification method.

The beauty of verifying with a changing bit of information (which is basically what is happining now) is that you only prove ownership once and the proof can't be stolen by someone who doesn't own the domain but received your proof.

Maybe I didn't understand correctly how it works. But if I understand it correctly that is actually rather dangerous. Supplying the proof to an untrustworthy party should not allow them to re-use this proof for other services.

Discussion

Live from the official Hacker News API

A modern reader for Hacker News · SvelteKit + Skeleton