Old Vidme embeds turn into porn after domain purchase • Hacker News Board

Re: Old Vidme embeds turn into porn after domain purchase

#121

Post by account42 » Wed, Jul 28, 2021, 1:12 PM UTC

strogonoff wrote: post #106

ignitionmonkey wrote: post #13

We can't and shouldn't expect people to keep their old domains forever. We need a way for pages to be signed and hyperlinks to enforce authorship. When we link to stuff, we should have a way to say whose stuff we're linking to. It's no different from installing signed software and using trusted repositories. This is one of the reasons I created a proof-of-concept web extension that verifies links and pages using PGP.…

Could URL authorship confirmation be implemented on top of TLS? If someone takes over a domain, the final certificate in the chain will be issued to another entity, and that could be enough to trigger a notice. Could be achievable with a centralized registry/crawler like Internet Archive, but one that only keeps track of domain:certificate mapping. Of course, the devil’s in the details (infrastructure/organizational…

Most certificates (including all free ones) are domain validated only so the entity being certified is just the domain and will not change with a new owner.

Re: Old Vidme embeds turn into porn after domain purchase

#122

Post by strogonoff » Wed, Jul 28, 2021, 4:15 PM UTC

account42 wrote: post #121

strogonoff wrote: post #106

Earlier quoted context omitted.

Could URL authorship confirmation be implemented on top of TLS? If someone takes over a domain, the final certificate in the chain will be issued to another entity, and that could be enough to trigger a notice. Could be achievable with a centralized registry/crawler like Internet Archive, but one that only keeps track of domain:certificate mapping. Of course, the devil’s in the details (infrastructure/organizational…

Most certificates (including all free ones) are domain validated only so the entity being certified is just the domain and will not change with a new owner.

If you’re talking about shared hosting, yes, it wouldn’t be covered by this model.

But other than that, if I have a cert fo xyz.com, and I abandon the domain, even if you buy it you’ll be forced to issue another cert for it.

If it was recorded somewhere that xyz.com = my cert, it could serve as a mechanism to verify that given URL is at least is supposed to be under my control and a warning could be shown if another certificate is being served now.

Kind of like HPKP, but with longer lifetime (longer than domain name registration term) and a centralized registry tracking certificate:domain mappings rather than each individual user agent cache.

Obviously, no one would adopt it due to being a devops nightmare.

Re: Old Vidme embeds turn into porn after domain purchase

#123

Post by account42 » Thu, Jul 29, 2021, 8:36 AM UTC

strogonoff wrote: post #122

account42 wrote: post #121

Earlier quoted context omitted.

Most certificates (including all free ones) are domain validated only so the entity being certified is just the domain and will not change with a new owner.

If you’re talking about shared hosting, yes, it wouldn’t be covered by this model. But other than that, if I have a cert fo xyz.com, and I abandon the domain, even if you buy it you’ll be forced to issue another cert for it. If it was recorded somewhere that xyz.com = my cert, it could serve as a mechanism to verify that given URL is at least is supposed to be under my control and a warning could be shown if another…

Right, you can pin the certificate or the public key in it - but that's much more specific than the entity that the cert is issued to and as you correctly noted is not practical for browsers to do automatically since keys and certs do get rotated without a change in owner.

Re: Old Vidme embeds turn into porn after domain purchase

#124

Post by oakwhiz » Thu, Jul 29, 2021, 6:30 PM UTC

sp332 wrote: post #6

oakwhiz wrote: post #4

Very amusing but I take issue with the article's claim that "Here’s (yet another) argument against using third-party embeds" - this might be an oversimpified perspective when it's actually a good argument to use subresource integrity (essentially cryptographic pinning of third party embedded content). I am unsure if this extends to every kind of resource that you could have in a web page, (ideally it should) but I co…

Subresource integrity would prevent the porn from showing up, but the videos would still be broken. Hosting the videos yourself is the option that would keep things running.

True, and HTML5 video tends to "just work," however I've found that many people have practical issues with hosting their own video. For example, not understanding video conversion, hosting behind bandwidth or request rate limitations, or not having anycast/CDN set up to hold the site together when a page unexpectedly goes viral. There are reasons that hosting videos yourself might not be an effective use of the resources or time available to you, especially based on technical skills, in which case third party hosting with pinning remains a better option.

Re: Old Vidme embeds turn into porn after domain purchase

#125

Post by one_off_comment » Mon, Aug 02, 2021, 3:27 PM UTC

duskwuff wrote: post #86

one_off_comment wrote: post #57

The weird thing about this to me is, the company or person who scooped up the domain... in order to get their plan working so quickly, wouldn't they have had to set up a site perfectly beforehand so the embeds would work as desired and then just sat there waiting, hoping, ready to hit the button to scoop up the domain at just the right time, praying nobody beat them to it? Isn't that a lot of work for almost no gain?

The embeds don't actually "work", per se. When the browser tries to load the embed into an , it gets redirected to the home page of the porn site, and ends up displaying the upper left corner of that page in the space where the video embed was supposed to go. It all looks rather more accidental than purposeful.

Ah, good to know. That explains it. I feel like this aspect was lost in reporting this. It was all made to sound much more deliberate.