3 ms·

A common practice (at least in the past) was universities that gave subdomains to students and student groups. The result is subdomains like studygroups and stu

by belorn 6y ago

A common practice (at least in the past) was universities that gave subdomains to students and student groups. The result is subdomains like studygroups and studentunions. In term of identity, students are part of an university, but in term of security, students are not trusted as much as the university itself. In term of technology it is even possible that the subdomain sits at its own name servers. Even for some of the largest websites on the world like google, I honestly doubt they consider subdomains to be as trusted as root domains. Are every single experimental project at google with its own subdomain as trusted and secure as root?

jeroenhd 6y ago
I've had this problem. I used one of my student domains to do research for a course, which required generating a new username and password. Bitwarden's default automagically filled in my uni credentials, which would give access to stuff like VPNs, grades, the whole deal! I've now configured the domain matching correctly, but the default has burned me more often than I'd like.
geofft 6y ago
Universities who do this should make sure that .example.edu (or perhaps .students.example.edu or .sites.example.edu or something) is on the Public Suffix List. (I'm hoping Bitwarden defines "base domain" as "one level past a public suffix"; if not, that's a serious bug.) Re trust - in practice, yes, they are, because anything.google.com can read google.com cookies. It's a pretty minor expense for me, a private individual, to register a new domain name: it's an even more minor expense for Google, even apart from the fact that they own .dev and .google and others.
- anilakar 6y ago
  IMHO the default HTTP trust model where a domain implicitly trusts its subdomains is at fault here, when the logical solution would be to remove the trust altogether or at least make it explicit both ways. With regard to Bitwarden's default behavior to match the whole domain, it's irritating even when it's not a risk. We manage a ton of our systems under the same domain to allow a single 2FA signon before even giving access to the individual services and all the credentials have to be manually set as host-only or they will be autofilled for every other system we're managing.
foxdev 6y ago
There was a long time where the only way to watch ExoSquad post-cancellation, unless you taped it, was to download it from a site hosted on someone's subdomain on a university domain.

by belorn 6y ago

jeroenhd 6y ago

I've had this problem. I used one of my student domains to do research for a course, which required generating a new username and password. Bitwarden's default automagically filled in my uni credentials, which would give access to stuff like VPNs, grades, the whole deal! I've now configured the domain matching correctly, but the default has burned me more often than I'd like.

geofft 6y ago

Universities who do this should make sure that .example.edu (or perhaps .students.example.edu or .sites.example.edu or something) is on the Public Suffix List. (I'm hoping Bitwarden defines "base domain" as "one level past a public suffix"; if not, that's a serious bug.) Re trust - in practice, yes, they are, because anything.google.com can read google.com cookies. It's a pretty minor expense for me, a private individual, to register a new domain name: it's an even more minor expense for Google, even apart from the fact that they own .dev and .google and others.

anilakar 6y ago
IMHO the default HTTP trust model where a domain implicitly trusts its subdomains is at fault here, when the logical solution would be to remove the trust altogether or at least make it explicit both ways. With regard to Bitwarden's default behavior to match the whole domain, it's irritating even when it's not a risk. We manage a ton of our systems under the same domain to allow a single 2FA signon before even giving access to the individual services and all the credentials have to be manually set as host-only or they will be autofilled for every other system we're managing.

foxdev 6y ago

There was a long time where the only way to watch ExoSquad post-cancellation, unless you taped it, was to download it from a site hosted on someone's subdomain on a university domain.