Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Microsoft mishandling example.com

tinyapps.org

Post reply on HN
Print view View original

51–60 of 93 posts

Re: Microsoft mishandling example.com

#51

Post by jve »

irusensei wrote: post #19
szszrk wrote: post #11

Earlier quoted context omitted.

My company used .local for EVERYTHING. I took it as normal at the time, until I got into problems with VMWARE products. Support patiently explained .local is reserved for something else and kindly provided Wikipedia links. They never responded why they used .local in their docs, trainings, webinars they provided, though :)

My impression is that Ballmer IE6 era Microsoft didn't gave a shit about standards.

Is standard you are talking about is Multicast DNS https://www.rfc-editor.org/rfc/rfc6762 from year 2013?

Re: Microsoft mishandling example.com

#52

Post by thequux »

ThePowerOfFuet wrote: post #33
wongarsu wrote: post #16

Earlier quoted context omitted.

brb, just filing paperwork to apply for the .tmptest gTLD /s

$100K

$227k just to apply, and another few hundred thousand in legal, compliance, and contracting to reach delegation.

Source: I'm on the board of dotMeow and wrote the financial plan

Re: Microsoft mishandling example.com

#53

Post by treyd »

gruez wrote: post #24
spiffyk wrote: post #23

Earlier quoted context omitted.

I would expect such a feature to use end-to-end encryption for the data, so that only the user can see the credentials. It does, right? Right?

>>multi-account sync and scheduled sending >I would expect such a feature to use end-to-end encryption for the data How would "end-to-end encryption" when such features by definition require the server to have access to the credentials to perform the required operations? If by "end to end" you actually mean it's encrypted all the way to the server, that's just "encryption in transit".

> If by "end to end" you actually mean it's encrypted all the way to the server, that's just "encryption in transit".

This is what Zoom claimed was e2ee for a little while before getting in trouble for it.

Re: Microsoft mishandling example.com

#54

Post by larrik »

hu3 wrote: post #6

This is why I never use these IANA-reserved domains like .test, .example, .invalid, .localhost. I always make up some impossible domains like domain.tmptest Otherwise you're one DNS "misconfiguration" away from sending dev logs and auth tokens to some random server. > Since at least February 2020, Microsoft's Autodiscover service has incorrectly routed the IANA-reserved example.com to Sumitomo Electric Industries' ma…

And then you fire off 100k emails, they all bounce, and your mail service shuts you off...

Re: Microsoft mishandling example.com

#55

Post by delfinom »

koakuma-chan wrote: post #38
brulx126 wrote: post #36

Earlier quoted context omitted.

Not just that, the new outlook app makes Microsoft a complete man-in-the-middle for your email account. https://www.xda-developers.com/privacy-implications-new-micr...

And? Do you think Gmail is end to end encrypted?

I think the concern is that it copies the emails of your non-Microsoft accounts that you added to the Outlook app, over to Microsoft servers

Re: Microsoft mishandling example.com

#56

Post by lazide »

gruez wrote: post #42
butvacuum wrote: post #37

Earlier quoted context omitted.

Basically everything microsoft makes that touches http will send your username and your password to any server that asks for Basic Authentication. It looks like Microsoft Edge had the _ability to disable_ this added in 2020 or 2021, but it isn't currently the default and the Group Policy unintuitively only applies to unencrypted HTTP Connections.

>Basically everything microsoft makes that touches http will send your username and your password to any server that asks for Basic Authentication. Are you talking about NTLM hashes? It's a weak hash, but not the same as "sending your password". The biggest difference is that even a weak hash can't be reversed if the password has high enough entropy.

Not necessarily, the server can say it only supports basic auth and….

Re: Microsoft mishandling example.com

#57

Post by WorldMaker »

ndriscoll wrote: post #21
irusensei wrote: post #5

Not surprised. They used to have training material incentivizing professionals to use .local as TLD for Active Directory realms. Thats a reserved domain for Multicast DNS. Working on Linux automation systems we would need to make sure to disable anything related to Avahi in our images otherwise name resolution would fail for some customers.

Haven't they been telling people to do that since before it became reserved? If so, the problem is more that you can't "reserve" something that's already in wide use, and mdns should've used something like .mdns. It's like when .dev became a gTLD, knowingly breaking a bunch of setups for a mix of vanity and a cash grab. Obviously dropped the ball on the engineering side.

Seems more a reason to never use stuff you don't actually control and are reserved for future purposes. Everyone knew who was in charge of DNS TLDs and that while they were being at first conservative in how many they assigned, they reserved the right to assign as many as they wanted.

But also, yes Microsoft documentation used .local before mDNS reserved it, and IIRC Microsoft was also involved in suggesting it for mDNS as mDNS came out of the multi-company standardization efforts from Apple's Bonjour. That said, my impression of most of that documentation from that time is that it was incorrectly using .local as a fake TLD where they should have been using .example or .example.com and also pointing people to the RFCs that those were not valid choices in a real setup. A problem with such documentation is that it is too easy to take literally. A follow up problem was sort of the "accidental security through obscurity" benefits of using non-globally resolvable addresses becomes "best practice" through essentially stubbornness and status quo (related to all the recent rediscussions on HN about NAT44 is not a firewall except by accident and you can have very good firewalls that aren't NAT44).

Re: Microsoft mishandling example.com

#58

Post by 1718627440 »

gruez wrote: post #13

>Microsoft's Autodiscover service misconfiguration can be confirmed via curl -v -u "email@example.com:password" " https://prod.autodetect.outlook.cloud.microsoft/autodetect/d... ": Hold up, does this mean outlook sends your full credentials to Microsoft when you try to set up an outlook account? I'm sure they pinky promise they keep your credentials secure, but this feels like it breaks all sorts of security/privacy…

Always has been.

Re: Microsoft mishandling example.com

#59

Post by dc396 »

hu3 wrote: post #6

This is why I never use these IANA-reserved domains like .test, .example, .invalid, .localhost. I always make up some impossible domains like domain.tmptest Otherwise you're one DNS "misconfiguration" away from sending dev logs and auth tokens to some random server. > Since at least February 2020, Microsoft's Autodiscover service has incorrectly routed the IANA-reserved example.com to Sumitomo Electric Industries' ma…

As others have pointed out, using 'tmptest' works until someone buys tmptest -- unlikely, but people will buy anything these days.

I always use the ISO-3166 "user-assigned" 2-letter codes (AA, QM-QZ, XA-XZ, ZZ), with the theory being that ISO-3166 Maintenance Agency getting international consensus to move those codes back to regular country codes will take longer than the heat death of the universe, so using them for internal domains is probably safe.

Re: Microsoft mishandling example.com

#60

Post by charles_f »

andreldm wrote: post #7

That’s why example.com states “Avoid use in operations”, not only that could create unnecessary traffic for them as well as leak information as in situations like this.

Yeah, it feels more like a safety net than something you should purposefully use
Post reply on HN