Users of the ICP-based bob.fun applications have been warned against accessing the services through their former web domains after the bob.fun domain stopped serving the applications.
OhShii Labs posted a security warning on X saying the bob.fun domain expired on September 3 and that both bob.fun and launch.bob.fun are currently unavailable as the application frontends. The company advised users to access the applications through their native ICP canister addresses instead.
The warning centres on the way Internet Identity handles application origins. Internet Identity documentation explains that alternative origins can be configured so different domains use the same user principal. However, the system cautions developers to add only domains they fully control because an alternative origin can authenticate users against the same principal as the primary origin.
According to OhShii Labs, the two bob.fun frontends are still live on-chain, but the custom domains are no longer serving the applications. The company says the applications currently list bob.fun and launch.bob.fun as alternative origins for the same Internet Identity account.
That creates a potential risk if the expired domain is acquired by another party and used to host a replica of the application. A user could potentially see an Internet Identity login prompt and approve it, believing they were interacting with the original service. Because alternative origins can share the same principal, a malicious replacement frontend could potentially gain the ability to submit transactions on behalf of an authenticated user.
Internet Identity’s own documentation describes the alternative-origin system as a way to keep a user’s principal consistent across domains controlled by the same service. It specifically warns that developers should never add third-party origins to the configuration.
OhShii Labs also warned about existing browser sessions. Internet Identity’s specification states that authentication delegations can have a maximum lifetime of 30 days, although applications can request shorter periods. The company said sessions associated with the two bob.fun frontends can remain active for up to about 30 days.
The company said its checks found that both frontends use the same derivation origin and that the alternative-origin configuration is controlled by the project’s canister infrastructure. It also noted an apparent discrepancy between registry information showing the domain as automatically renewed and registrar information showing the September 3 expiration, saying the registry status should not be treated as confirmation that the project team has regained control of the domain.
Until ownership and control of the domains are confirmed, OhShii Labs is advising users not to log in through bob.fun or launch.bob.fun. Users who previously accessed the applications through those domains have also been advised to clear stored site data for the domains in their browsers.
For the project team, the company recommends removing the two custom domains from the Internet Identity alternative-origins configuration. Internet Identity’s documentation confirms that removing an alternative origin prevents it from being used for future principal derivation, although existing authentication sessions may still need to expire or be cleared.
The warning does not indicate that the underlying applications or their on-chain canisters have been compromised. Rather, it concerns the security implications of losing control of a web domain that remains configured as an authorised alternative origin.
For now, users are being urged to use the applications’ native ICP addresses rather than the former custom domains and to avoid approving Internet Identity requests presented through bob.fun or launch.bob.fun.
Dear Reader,
Ledger Life is an independent platform dedicated to covering the Internet Computer (ICP) ecosystem and beyond. We focus on real stories, builder updates, project launches, and the quiet innovations that often get missed.
We’re not backed by sponsors. We rely on readers like you.
If you find value in what we publish—whether it’s deep dives into dApps, explainers on decentralised tech, or just keeping track of what’s moving in Web3—please consider making a donation. It helps us cover costs, stay consistent, and remain truly independent.
Your support goes a long way.
🧠 ICP Principal: ins6i-d53ug-zxmgh-qvum3-r3pvl-ufcvu-bdyon-ovzdy-d26k3-lgq2v-3qe
🧾 ICP Address: f8deb966878f8b83204b251d5d799e0345ea72b8e62e8cf9da8d8830e1b3b05f
Every contribution helps keep the lights on, the stories flowing, and the crypto clutter out.
Thank you for reading, sharing, and being part of this experiment in decentralised media.
—Team Ledger Life
Community Discussion