3 ms·
Universities who do this should make sure that .example.edu (or perhaps .students.example.edu or .sites.example.edu or something) is on the Public Suffix List.
by geofft 6y ago
Universities who do this should make sure that .example.edu (or perhaps .students.example.edu or .sites.example.edu or something) is on the Public Suffix List. (I'm hoping Bitwarden defines "base domain" as "one level past a public suffix"; if not, that's a serious bug.)
Re trust - in practice, yes, they are, because anything.google.com can read google.com cookies. It's a pretty minor expense for me, a private individual, to register a new domain name: it's an even more minor expense for Google, even apart from the fact that they own .dev and .google and others.
- anilakar 6y agoIMHO the default HTTP trust model where a domain implicitly trusts its subdomains is at fault here, when the logical solution would be to remove the trust altogether or at least make it explicit both ways. With regard to Bitwarden's default behavior to match the whole domain, it's irritating even when it's not a risk. We manage a ton of our systems under the same domain to allow a single 2FA signon before even giving access to the individual services and all the credentials have to be manually set as host-only or they will be autofilled for every other system we're managing.