Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

It's Way Too Easy to Get a .gov Domain Name

krebsonsecurity.com

Post reply on HN
Print view View original

81–90 of 184 posts

Re: It's Way Too Easy to Get a .gov Domain Name

#81

Post by tomjakubowski »

krustyburger wrote: post #51
bonyt wrote: post #17

> A review of the Top 10 most populous U.S. cities indicates only half of them have obtained .gov domains, including Chicago, Dallas, Phoenix, San Antonio, and San Diego. > Yes, you read that right: houston.gov, losangeles.gov, newyorkcity.gov, and philadelphia.gov are all still available. As is the .gov for San Jose, Calif., the economic, cultural and political center of Silicon Valley. A minor nit: Many of these ci…

I would assume the LA City one was chosen because it’s still shorter than Los Angeles and it also differentiates from LA County. Much of the LA metropolitan area is within the county limits but not part of the city of LA.

yeah, the county website is likewise https://www.lacounty.gov/

Re: It's Way Too Easy to Get a .gov Domain Name

#82

Post by ptaipale »

xyz-x wrote: post #76

Does anybody know why the USA hogs the toplevel domain? It's not the only government in the world. It would seem more just to make it more like .com than .edu.

Obviously, because of history of Internet deriving from Arpanet. The whole domain name structure grew out of the needs of the US government, even if the .com domain was largest TLD from the start.

Re: It's Way Too Easy to Get a .gov Domain Name

#83

Post by tsukurimashou »

curiousgal wrote: post #80

Tangent. This guy has the best and probably most read blog on cybersecurity incidents. He's smart enough to serve ads from his own domain but can't even bother to make his site mobile friendly? I've seen people pick on the sites of free tools and side projects for the same reason but somehow this gets a pass.

he does whatever he wants

Re: It's Way Too Easy to Get a .gov Domain Name

#84

Post by frozenport »

curiousgal wrote: post #80

Tangent. This guy has the best and probably most read blog on cybersecurity incidents. He's smart enough to serve ads from his own domain but can't even bother to make his site mobile friendly? I've seen people pick on the sites of free tools and side projects for the same reason but somehow this gets a pass.

Looks fine on mobile Firefox

Re: It's Way Too Easy to Get a .gov Domain Name

#85

Post by paggle »

cpeterso wrote: post #65
bonyt wrote: post #17

> A review of the Top 10 most populous U.S. cities indicates only half of them have obtained .gov domains, including Chicago, Dallas, Phoenix, San Antonio, and San Diego. > Yes, you read that right: houston.gov, losangeles.gov, newyorkcity.gov, and philadelphia.gov are all still available. As is the .gov for San Jose, Calif., the economic, cultural and political center of Silicon Valley. A minor nit: Many of these ci…

The city of Lafayette's police department (in the SF East Bay) accepts crime tip emails using a Gmail address (94549TIP@gmail.com). It's plastered on all their police cars, even though the city and police department have an official domain. Though even that is a .org domain, lovelafayette.org.

Well presumably one would not be feeling much “Love Lafayette” when reporting crimes.

Re: It's Way Too Easy to Get a .gov Domain Name

#86

Post by paggle »

katet wrote: post #6
forgingahead wrote: post #2

Good reporting, until this paragraph: Now consider what a well-funded adversary could do on Election Day armed with a handful of .gov domains for some major cities in Democrat strongholds within key swing states: The attackers register their domains a few days in advance of the election, and then on Election Day send out emails signed by .gov from, say, miami.gov (also still available) informing residents that bombs…

I see what you mean, but I suspect the author might be referring to the Russian disinformation campaign to favour Republicans. I see it just as an example - obviously it can be adapted in either direction, or both just to deter voter participation altogether.

I don’t think the Russian agenda favors Republicans — it favors sowing chaos. Trump was certainly that candidate in 2016 but that could change.

Re: It's Way Too Easy to Get a .gov Domain Name

#87

Post by mijamo »

semi-extrinsic wrote: post #46
profmonocle wrote: post #22

Earlier quoted context omitted.

> Some cities may also use a subdomain of their states domain, which may or may not be a .gov. This reminds me of how longwinded the domain hierarchy for .us originally was. In MN (not sure if it's the same for every state), city domains were "www.ci.cityname.mn.us". Then the school district's web site was "www.cityname.k12.mn.us". Not only was the order inconsistent (why not www.k12.cityname etc.?) but sometimes the…

In Norway, people employed by the local municipalities have email adresses that are literally of the style $firstname[.$middlename].$lastname@employee.$municipalityName.municipality.no where "employee" and "municipality" are literal strings (in Norwegian) and the others are variables. It's incredible, I've seen people with 50 character long email addresses.

Why is that incredible? It is pretty common for many institutions to have that kind of email. Universities for instance often have similar emails so that just by looking at the email you know if the person is a teacher / student / temp worker and which chair they belong to, sometimes which campus in addition.

Many big companies have similar things to identify the BU of the email holder or indicate a contractor status (helpful for security policies).

Re: It's Way Too Easy to Get a .gov Domain Name

#88

Post by HNLurker2 »

Thorrez wrote: post #70
HNLurker2 wrote: post #54

This is what I used to do back in the day, to get high pagerank(remember that?) In Google

If we go back to the original PageRank algorithm, I don't think it would be affected by this attack. The original algorithm just counts the number of links (or number of sites making links), not the TLDs. So a .com site would be just as good as a .gov site.

Yes but they used to had, I remember correctly higher PR. Back in the day (Twitter had 10, Google had 9 and any gov had 7 atleast) I used to buy those and link to my directory webs.

Re: It's Way Too Easy to Get a .gov Domain Name

#89

Post by Spare_account »

krustyburger wrote: post #51
bonyt wrote: post #17

> A review of the Top 10 most populous U.S. cities indicates only half of them have obtained .gov domains, including Chicago, Dallas, Phoenix, San Antonio, and San Diego. > Yes, you read that right: houston.gov, losangeles.gov, newyorkcity.gov, and philadelphia.gov are all still available. As is the .gov for San Jose, Calif., the economic, cultural and political center of Silicon Valley. A minor nit: Many of these ci…

I would assume the LA City one was chosen because it’s still shorter than Los Angeles and it also differentiates from LA County. Much of the LA metropolitan area is within the county limits but not part of the city of LA.

The issue with lacity.org is the TLD, which creates confusion amongst the general public.

Legitimate domains for government entities should ALL be on .gov, which should be rigorously controlled.

Then I can tell my family to trust any .gov site, and assume that anything else is fraudulent.

lacity.org undermines this.

Re: It's Way Too Easy to Get a .gov Domain Name

#90

Post by dylz »

rshnotsecure wrote: post #42

I would also like to add signing up for an AWS Gov account was at least 12 months ago...a completely automated process where I was approved in no more than 15 mins. The account had a credit card but otherwise was 100% still in free tier mode, and in fact was being used by an open source team so it included ppl from around the world. The CIA has stated multiple times in court documents (typically they have emerged in…

Sharktech/Nobistech is basically just Leaseweb, a VPS/dedicated server company. I don't believe it to be particularly linked.

And "No 31 Jin-rong Street" is like multiple /8's worth of users, China's largest ISP.

Post reply on HN