Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

It's Way Too Easy to Get a .gov Domain Name

krebsonsecurity.com

Post reply on HN
Print view View original

71–80 of 184 posts

Re: It's Way Too Easy to Get a .gov Domain Name

#71

Post by why_only_15 »

frei wrote: post #58
KingMachiavelli wrote: post #41

Isn't the main issue that TLDs are a poor way of establishing trust? Otherwiae does every company and government need to get specialized TLDs to prevent impersonation? Even then it only works is users know and always notice the domain. EV certs are dead for good reason but nothing seems to have replaced them. I guess the only option is to verify each site once and then bookmark it and always make sure it's https. But…

Well the back of my Chase card says chase.com. If you tend to use search engines to find websites, you are trusting the search engine to give you the website for Chase Bank.

I feel like google is less likely to give me something fraudulent than e.g. the risk of me misspelling chase or the like

Re: It's Way Too Easy to Get a .gov Domain Name

#72

Post by yoaviram »

Thorentis wrote: post #29

> “I used a fake Google Voice number and fake Gmail address,” said the source, who asked to remain anonymous for this story but who said he did it mainly as a thought experiment. I don't think "thought experiment" applies to actually carrying out what you were thinking about.

Came here to say the same thing. I'm surprised how often people misuse the term. Here's my attempt at explaining what are thought experiments: https://thoughtexperiments.net/pages/on-thought-experiments/

Re: It's Way Too Easy to Get a .gov Domain Name

#73

Post by distances »

lifthrasiir wrote: post #47
CydeWeys wrote: post #35

Earlier quoted context omitted.

That's not how .nyc is used or is expected to be used. It's a top-level domain, not a dotless host name. Here's an example of how it's used: https://thecity.nyc/

> That's not how .nyc is used or is expected to be used. It's a top-level domain, not a dotless host name. While it is prohibited by the ICANN policy [1], it is not strictly enforced so that there are multiple TLDs with A/AAAA records. They traditionally could be resolved with a trailing dot (thus it is not a dotless host name, that would have no dot), but nowadays many browsers refuse to resolve them without an expl…

Your .pn link doesn't work for me without www part.

At least for https://www.fi/ the case is that someone registered "www" as the domain name in the early days.

Re: It's Way Too Easy to Get a .gov Domain Name

#74

Post by konklone »

dragonwriter wrote: post #50
pishpash wrote: post #45

Earlier quoted context omitted.

LA gov doesn't belong to CA gov, federalism, etc.

> LA gov doesn't belong to CA gov, federalism, etc. Federalism does not exist within states but between states and the federal government. Los Angeles (whether county or city) is an administrative subdivision of the State of California, not an separate sovereignty. OTOH, Los Angeles isn't getting a .ca.gov domain because the state government doesn't want to dilute it's brand with local government websites, but that's…

There's not federalism within states in a legal sense the way there is between states and the feds, but cities value their independence too and prefer to have their own infrastructure. I would expect the city, rather than the state, to be the reason they don't use a subdomain of the state's .gov domain.

Re: It's Way Too Easy to Get a .gov Domain Name

#75

Post by kevingadd »

drak0n1c wrote: post #64
save_ferris wrote: post #36

Earlier quoted context omitted.

The Houston Chronicle reported today that the Texas GOP plans to purchase several domains resembling democratic candidates and run active disinformation campaigns against them using fake campaign sites[0]. Might’ve had something to do with it. 0: https://www.houstonchronicle.com/news/politics/texas/article...

Another news story today is the lawsuit against the "Devin Nunes' Cow/Mother" Twitter accounts run by anonymous DNC personnel. In each of these incidents the "disinformation" label is used by partisan officials and obsessively repeated by the media (because the creator's identity is not placed in large font at the top), but anyone who looks at it themselves can clearly see that such is satire and opposition material.…

When was it confirmed that those twitter accounts were run by the DNC and not just ordinary people? Did the owners break anonymity to the press to prove ownership even though a lawsuit is trying to reveal their identity? That's wild.

Re: It's Way Too Easy to Get a .gov Domain Name

#77

Post by lifthrasiir »

distances wrote: post #73
lifthrasiir wrote: post #47

Earlier quoted context omitted.

> That's not how .nyc is used or is expected to be used. It's a top-level domain, not a dotless host name. While it is prohibited by the ICANN policy [1], it is not strictly enforced so that there are multiple TLDs with A/AAAA records. They traditionally could be resolved with a trailing dot (thus it is not a dotless host name, that would have no dot), but nowadays many browsers refuse to resolve them without an expl…

Your .pn link doesn't work for me without www part. At least for https://www.fi/ the case is that someone registered "www" as the domain name in the early days.

Hmm, I guess the current browsers simply don't like such domain and automatically put www. At the very least, the Google DNS gives the following:

    ai. 209.59.119.34
    cm. 195.24.205.60
    dk. 193.163.102.58
    gg. 87.117.196.80
    je. 87.117.196.80
    pn. 80.68.93.100
    tk. 217.119.57.22
    uz. 91.212.89.8
    ws. 64.70.19.33
But I agree that these domains are now out of luck, given that browsers no longer even remotely support them.

Re: It's Way Too Easy to Get a .gov Domain Name

#80

Post by curiousgal »

Tangent.

This guy has the best and probably most read blog on cybersecurity incidents. He's smart enough to serve ads from his own domain but can't even bother to make his site mobile friendly? I've seen people pick on the sites of free tools and side projects for the same reason but somehow this gets a pass.

Post reply on HN