14 ms·

> And that's the price we pay for anyone being able to buy their own domain and run their own secure site. No, that's the price we pay for using a name resolut

• acvny 7y ago
  yes, very wrong conclusion. the author blames cheap domains and easy to get https. You could as well blame cheap computers, cheap internet access, cheap electricity. Since that looked like an SMS, I would report it to your mobile provider, let them track who sent the message.
  • edent 7y ago
    I'm the author. I'm not blaming cheap domains. I'm saying that spam like this is a consequence of cheap domains. The blame lies at the feet of the spammers. And, I've worked for a couple of mobile providers. This spam was likely sent from a disposable pre-paid SIM. There's no realistic way to check who sent it.
    • bostik 7y ago
      So the phone/device IMEI is not recorded for the session? Not that it would tell who sent it, but would allow to track if the same devices were used as part of ongoing campaign.
      • edent 7y ago
        The sending network may have a record of the IMEI, but I don't think the receiving one gets it. But SMS sending devices are cheap and disposable. Sure, it's illegal to alter your IMEI in the UK - but if they're already committing one crime, I don't think that'll stop them.
    • badrabbit 7y ago
      And who sent it shouldn't be recorded. Your problem is not the spammers but the reason users fall for the phish. Why are prepaid pins special and free email is not?
    • ryanlol 7y ago
      Sending bulk sms costs waaaay more than any domain. This theory doesn’t really make any sense.
      • edent 7y ago
        Bulk SMS costs around 1p/message - if you're sending from the UK. If you're sending from overseas it can be significantly cheaper. So, sending a couple of hundred messages is about the same price as a domain. Of course, if you've stolen a SIM or hacked peoples' phone in order to send the messages, it's even cheaper.
        • ryanlol 7y ago
          IME good providers tend to charge at least 2p/message. You also need to get decent leads from somewhere or your conversion rates will suck. Then there’s also a significant time investment in setting up accounts with those SMS services that’ll constantly be banning you. Couple of hundred messages isn’t going to get you very many hits unless you’re collecting low value information.
    • thefounder 7y ago
      Chances are the scammers didn't even pay the domain name or the SMS. Maybe the real issue is the state of payment services. You provide some random numbers in an unknown form....and this is since forever. How stupid is that? Things like Apple Pay seem to go a bit in the right direction but at the root you still use that random card number as identity/authentication.
    • danShumway 7y ago
      > I'm saying that spam like this is a consequence of cheap domains. Technically correct, but the thing is, spam like this is a consequence of a lot of things. Why draw attention to that specific cause out of everything else? You could just as accurately say that spam like this is a consequence of human-readable domains. If humans weren't visually validating URLs, it would be impossible for a scammer to use unicode tricks to make a URL look legitimate. A lack of gatekeepers means we'll have more scammers, yes. But, gatekeepers almost universally don't scale well in any system as large as the Internet, and they come with so many additional problems that they're not worth paying special attention to or prioritizing as a solution to any problem on this scale.
    • prox 7y ago
      If you watch kitboga (youtube / twitch) and in the odd chance kitboga gets to talk about why they do it the spammers fall into a couple of categories: 1) The angry/evil spammer. Doesn’t give a shit and wants make his dollars. Usually someone higher up. 2) The worker. Just his bills paid. Usually rather uncaring what they are doing, although they acknowledge its wrong 3) Playing oblivious, just ignoring and avoiding any sense of blame or justice It’s lucrative and as long as we keep falling for it, it will stay. Making domains more expensive will make the barrier of entry higher, but the top players will likely just consolidate more resources vs little scammers. If a domain is like an address then maybe we could or should enforce some more legitimacy, but such a thing would be hard to implement in the countries where spam usually originates from.
  • acomjean 7y ago
    The fact that we were trained to look for https as a sign of legitimacy.. it kinda bugs me that letsencrypt which is a fantastic public service is being abused by scammers in this way. Anonymity all the way down the stack...
    • toohotatopic 7y ago
      It's legitimacy for the connection, not for the domain. Who trains people to trust every domain?
      • Deukhoofd 7y ago
        Banks did for a while, many banks told you to look for the green padlock to ensure it was the right site.
      • wongarsu 7y ago
        An EV certificate is still a decent proxy for legitimacy: it's somewhat expensive to get and allows you to track down a legal entity. Both points deter scammers and other evil-doers, even if they don't completely prevent them. Sadly there's no way to judge from just the URL if a site has an EV cert or just a cheap/free https cert, and by the time you opened it in the browser it might be too late.
        • PeterisP 7y ago
          A lack of EV certificate is not a decent proxy for legitimacy, because most of legitimate important sites don't have an EV certificate - so people can't be trained to think that they should think twice if an EV certificate is absent.
          • SmellyGeekBoy 7y ago
            EV certificates are a scam anyway.
          • wongarsu 7y ago
            I sure would do a double take if I noticed a bank website using a non-EV cert or an EV cert issued to somebody other than the bank. But that's probably one of the few industries where you can expect it.
  • LinuxBender 7y ago
    The messages are spoofed. The attacker has access to a SS7 signalling link and you can set the source number to anything you want. Telco's share some blame in facilitating this. I tried to stop of of this in the 90's and was told to help the scammers send messages faster. I wanted to terminate their SS7 links but I would have been fired for doing so. To clarrify, the individual scammer may not even know what a SS7 link is. It's usually a tiered system, where one shady person has access to a link, then sells access via bitcoin to other shady people via some tor web interface. As for the domain name, that problem isn't going away. If anything, it will only get worse, as people are lazy and push UX designers to show less and less information. And the UX devs are right, the users won't know what to do with the extra info most of the time anyway. And then there are payment processors, who also teach people BAD habits, by sending HTML messages, clickable links, etc. And that isn't going to change because it would increase customer support cases which costs them money. Banks won't implement secure authentication beyond phone MFA for the most part. I can think of a dozen ways to make this more secure, but all the ideas would be rejected as adding too much friction. All that is left is educating the masses and that fails as well. Most people learn by making mistakes. About 40% of people will click on the scammers links. About 10% of people will enter their credentials.
    • belorn 7y ago
      > All that is left is educating the masses and that fails as well. That is not always true. You can have regulations which force banks to change. Banks don't like it but politicians don't like an unstable banking sector, especially if it causes sharp changes in the stock market. As an example, the recent money laundering scandals in Sweden has caused some changes in credit card security. Politicians want to reassure the public and increase trust in Swedish banks, so the last years has seen several notable banking regulations. I would guess that they actually want noticeable friction in order to reassure the public that they have things under control.
      • LinuxBender 7y ago
        That is excellent. I would love to see this pattern spread around the world.
• thepete2 7y ago
  I think it's time stuff like domains and basic internet things like that need to become part of the school curriculum. Education is the only way to combat these things.
  • O_H_E 7y ago
    Yes, agree. A few weeks ago I had an argument with a few engineering students is one of the 30 top schools in the world, whether you can send an email form Gmail to Outlook or not!! They thought it was like Messenger and WhatsApp not being able to talk to each other. The concept of Open protocols and clients have to be taught in school. Oh, how puzzled the looked when I showed them my Outlook email on my phone's Gmail app. I was agitated.
  • potatoz2 7y ago
    I'm not convinced knowing about how this works is the solution. Plenty of software engineers that understand TLS/DNS/etc. get phished because it only takes a few minutes of distraction. The same principle applies in medicine or aviation: without systems in place, even the most educated person will predictably fail at least some of the time.
• snarf21 7y ago
  This is probably unpopular but I think domains should just cost more. We don't all need our own name as a domain. Make them cost $500 or $1000 a year. [This money goes to ICANN, W3C, etc.] That is nothing for a business but would make scammers and link farms (more) unprofitable. You could still make .org free but it requires sending 501c3 (or similar) documentation to the registrar. If you want a phone line you have certain fees for 911 and other regulations to help pay for the infrastructure and this is very similar in terms of a naming and communication service.
  • badrabbit 7y ago
    That opinion is unpopular for good reason. A financial barier to prevent crime implies lack of petty money is the cause of the crime. You can make 10x what you said with the simplest scam targeting a few million valid recipients within a week. Even if your solution would solve the problem, it would destroy the purpose of the system. Throwing the proverbial baby with the bath water. If I want a phone line it costs me $10 to get a sim card from walmart. Most reputable TLDa cost a ton more. I mean what is it with this lazy way of solving real problems. What's next, tax domain registrations? Require a government ID? How ridiculous, this is what happens when humans give up their basic freedoms to goverenments and ruling classes. By what authority are you even regulating my free speech here? If I put up a website, I am not engaging in commerce unless I sell or buy something using that site. It is the equivalent of me calling myself a name and making a speech in public and you want to charge me £1000 for the right to call myself a name or to label the soap box I stand on a name so others can distiguish me. The fact that scammers also stand in soap boxes and make false claims for profit does not magically give you, your ruling class or the goverenmen t authority to regulate soap box labels and tax speech. Even if this has popular support, free speech is a natural right. You can police harmful/false speech retroactively but you can't inhibit speech proactively to deter a possible crime unless you can guarantee your measure affects only law breakers.
    • snarf21 7y ago
      You are welcome to disagree but I guess I am missing your point. Having a website doesn't require a domain. DNS is a vanity layer on top to make it more user friendly and provide an abstraction layer. Domain registration costs money today. According to your argument that should be free or it is limiting your speech. I never said anything about speech or what you use the domains for. If it is yours, do whatever you want with it. Ethos bought .org for $1B. Why should a private equity company be able to own DNS suffixes? Are you okay with that? The issue at hand is that these domains are being created specifically to deceive. This is an issue of consumer protection and greater good. The US just passed bigger fines for robo-callers. Everyone seems fine with not getting scam phone calls from their own phone number. Is this a restriction of free speech? Everyone isn't allowed to run their own tv or radio station, it is regulated. Is that limiting your free speech? You can't make up your own phone number. If you want a special 800 number that is more memorable, you have to pay the phone company lots of extra money for it. I'm merely suggesting similar.
• tinus_hn 7y ago
  No, it’s the price you pay for trusting concepts that are not intended to be trustworthy. No matter what you come up with, as long as you train people to do things wrong there will always be a way to fool them. No company should send messages containing a url that requires login, payment data or the like. People should go to these places by typing the url or by using their own bookmarks.
  • thinkloop 7y ago
    > No company should send messages containing a url that requires login, payment data or the like. People should go to these places by typing the url or by using their own bookmarks. Maybe they don't? This wouldn't help here, that's not the company sending the message. For that to work, people have to deeply know and trust the policies and resolve of each of their service providers not to do that - might as well just teach them how links work.
    • tinus_hn 7y ago
      No, because that’s impossible. Are you going to teach them to distinguish between l and I in sans serif fonts? Or one of the look alike Unicode symbols? That roads leads nowhere but blaming someone else for a problem you brought yourself. You can’t trust links by visually inspecting them.
• deleted 7y ago
  [deleted]
• zamadatix 7y ago
  The price we pay (scammers registering date based domain names) is due to the name resolution system being decoupled from the infrastructure we use to establish domain ownership and authority? How is looking up the domain supposed to give you more validation than the domain being assigned in the first place? Right now that infrastructure is the only thing in the stack that actually does any validation (you get your cert because you have the name). There isn't any other validation infrastructure to couple it to for it to be "decoupled".
• rjsw 7y ago
  It didn't have to be that order for DNS, JANET NRS [1] had the most authoritative part on the left. [1] https://en.wikipedia.org/wiki/JANET_NRS https://en.wikipedia.org/wiki/JANET_NRS
  • xyz20200102 7y ago
    According to Paul Mockapetris who designed the DNS, domain names are little-endian to make autocompletion easier and to allow unqualified "local" names (e.g. "bilbo" instead of "bilbo.cs.college.edu").
• joe_the_user 7y ago
  Oh, we have a doubly problematic system. The Internet became the standard for global networking in the 1990s by being an informal trust based system where the competition was things like Al Gore's Information Superhighway - these other hypothetical systems were centralized extension of something like a cable TV network and essentially had all the bad things we decry in today's Internet and none of the good. Which to say, the lack of centralization in DNS or whatever aspects on might name in the Internet (IP addresses, etc) allows bad actors from below to do their terrible things. But the lack of centralization also prevents bad actors from above from doing their terrible things. Centralized DNS is already a target - cable companies were complaining to congress about firefox from enabling secure DNS and keeping them from MTM traffic. Which is worse? I couldn't say.
• ljm 7y ago
  For some time I've wondered what the internet would look like if we used reverse domain notation (like with software package identifiers), which I think would mitigate this issue. `com.01-01-2020-billing.secure.hsbc` or whatever looks a hell of a lot more dodgy. But I presume it comes with a whole lot of issues of its own.