Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

It's Way Too Easy to Get a .gov Domain Name

krebsonsecurity.com

Post reply on HN
Print view View original

91–100 of 184 posts

Re: It's Way Too Easy to Get a .gov Domain Name

#91

Post by aaron695 »

This is dumb.

If someone is doing this, then link?

Else it's obviously to much bother, you're domain will get axed.

Compare to all the domains that won't get axed.

Do they real expect us to believe the population will get fooled on a losangeles.gov but not losangelesgovernment.ws, the difference will be a small percent.

> then on Election Day send out emails signed by .gov

Why the hell won't these be junked like any spam? New domain. Sudden flood. People marking as spam. What, are we in 2010?

Re: It's Way Too Easy to Get a .gov Domain Name

#92

Post by curiousgal »

tsukurimashou wrote: post #83
curiousgal wrote: post #80

Tangent. This guy has the best and probably most read blog on cybersecurity incidents. He's smart enough to serve ads from his own domain but can't even bother to make his site mobile friendly? I've seen people pick on the sites of free tools and side projects for the same reason but somehow this gets a pass.

he does whatever he wants

So do I, which is why I blocked all images on his site.

Re: It's Way Too Easy to Get a .gov Domain Name

#93

Post by smcl »

forgingahead wrote: post #2

Good reporting, until this paragraph: Now consider what a well-funded adversary could do on Election Day armed with a handful of .gov domains for some major cities in Democrat strongholds within key swing states: The attackers register their domains a few days in advance of the election, and then on Election Day send out emails signed by .gov from, say, miami.gov (also still available) informing residents that bombs…

Well, yes and no. Yes - he could've chosen not to name a party at all and the point would have stood. However it's not simply a matter of opinion to suggest that the Republican party attempt nefarious electoral tricks to discourage (or outright ban) people from voting. It's now pretty much party policy.

Re: It's Way Too Easy to Get a .gov Domain Name

#94

Post by Biganon »

tsukurimashou wrote: post #83
curiousgal wrote: post #80

Tangent. This guy has the best and probably most read blog on cybersecurity incidents. He's smart enough to serve ads from his own domain but can't even bother to make his site mobile friendly? I've seen people pick on the sites of free tools and side projects for the same reason but somehow this gets a pass.

he does whatever he wants

...yeah? And? Everyone does whatever they want, not even criminal law makes it impossible to act a certain way. What's your point? It's still a terrible design choice, and it alienates a great number of potential readers.

Re: It's Way Too Easy to Get a .gov Domain Name

#95

Post by neiman »

Together with selling .org to Ethos Capital, we're getting a worrying picture of problems with the current model of managing TLDs.

Managing TLDs is a lot of power in 2019, since the Internet is such a powerful player now.

I'm not sure what's the best way to manage it, but I am sure that if we leave it as is, we'll see more and more deal with dodgy commercial entities or more entities getting domain names they should not own.

Re: It's Way Too Easy to Get a .gov Domain Name

#96

Post by Biganon »

iamleppert wrote: post #28

Sounds to me like this researcher is going to be brought up on charges. Well deserved charges. We don’t know what he did with this domain before he contacted krebs. He very well could be covering his tracks and creating plausible deniability. You break the law, you go to jail. Simple as that. They aught to make an example out of him.

"You break the law, you go to jail. Simple as that."

This is laughably ignorant. It's absolutely not simple as that, by chance.

Re: It's Way Too Easy to Get a .gov Domain Name

#97

Post by ryanlol »

iamleppert wrote: post #28

Sounds to me like this researcher is going to be brought up on charges. Well deserved charges. We don’t know what he did with this domain before he contacted krebs. He very well could be covering his tracks and creating plausible deniability. You break the law, you go to jail. Simple as that. They aught to make an example out of him.

Is there a point you’re trying to make with this weird tirade?

Re: It's Way Too Easy to Get a .gov Domain Name

#98

Post by Symbiote »

lifthrasiir wrote: post #47
CydeWeys wrote: post #35

Earlier quoted context omitted.

That's not how .nyc is used or is expected to be used. It's a top-level domain, not a dotless host name. Here's an example of how it's used: https://thecity.nyc/

> That's not how .nyc is used or is expected to be used. It's a top-level domain, not a dotless host name. While it is prohibited by the ICANN policy [1], it is not strictly enforced so that there are multiple TLDs with A/AAAA records. They traditionally could be resolved with a trailing dot (thus it is not a dotless host name, that would have no dot), but nowadays many browsers refuse to resolve them without an expl…

http://ai./ is a better example.

Re: It's Way Too Easy to Get a .gov Domain Name

#99

Post by ryanlol »

dylz wrote: post #90
rshnotsecure wrote: post #42

I would also like to add signing up for an AWS Gov account was at least 12 months ago...a completely automated process where I was approved in no more than 15 mins. The account had a credit card but otherwise was 100% still in free tier mode, and in fact was being used by an open source team so it included ppl from around the world. The CIA has stated multiple times in court documents (typically they have emerged in…

Sharktech/Nobistech is basically just Leaseweb, a VPS/dedicated server company. I don't believe it to be particularly linked. And "No 31 Jin-rong Street" is like multiple /8's worth of users, China's largest ISP.

https://news.ycombinator.com/item?id=21412052

According to rshnotsecure every hosting company seems to be a government front, even really small ones like ramnode.

Re: It's Way Too Easy to Get a .gov Domain Name

#100

Post by Tempest1981 »

mike_hock wrote: post #69
cpeterso wrote: post #65

Earlier quoted context omitted.

The city of Lafayette's police department (in the SF East Bay) accepts crime tip emails using a Gmail address (94549TIP@gmail.com). It's plastered on all their police cars, even though the city and police department have an official domain. Though even that is a .org domain, lovelafayette.org.

So an email address that looks like a fraud (or just random) and a domain name that looks like a porn site.

94549 is their city zip code. And a palindrome.
Post reply on HN