5 ms·
This is a good opportunity to inform folks about the Public Suffix List[1]. In short, there is no algorithmic way to know how far up a subdomain is controlled b
by pavon 6y ago
This is a good opportunity to inform folks about the Public Suffix List[1]. In short, there is no algorithmic way to know how far up a subdomain is controlled by a single entity. For example ".org", ".co.uk", and ".cloudfront.com" are all public suffixes where subdomains under them are controlled by different entities. Mozilla created[2] the public suffix list to document these regions of control. If you write any software that gives subdomains the same privilege as the base domain, you should (at a minimum) check this list and verify that the subdomain is not known to be controlled by a different party. If you share a domain across multiple entities, you should add your domain to the public suffix list. I don't know if bitwarden uses PSL or not.
I learned about this from gorhill who is very diligent about appling this in uMatrix, etc[3].
[1]https://publicsuffix.org/ https://publicsuffix.org/
[2]https://wiki.mozilla.org/Public_Suffix_List https://wiki.mozilla.org/Public_Suffix_List
[3]https://github.com/gorhill/uMatrix/issues/264 https://github.com/gorhill/uMatrix/issues/264
- tpetry 6y agoI am shocked how broad the list has grown. A few years ago it only contained the iana domains now there are many domains for cloud services etc.
- paulryanrogers 6y agoThis seems to be an inevitable outcome as ICANN has sold out. It should have been an international non-profit once the significance of domain names became clear.
- mekster 6y agoICANN is a mess, look at the pricing of new TLD like .rich. It's all joke because it's not a neutral entity with proper peer pressures. ICANN is one of the internet's failure.
- FDSGSG 6y agoHow does this have anything to do with ICANN selling out?
- paulryanrogers 6y agoTLDs proliferated which contributes to weaknesses like this one in BitWarden.
- FDSGSG 6y agoTLD proliferation has nothing to do with this problem though.
- tialaramex 6y agoRyan Sleevi suggests (perhaps that's putting it too mildly) that further reliance on the PSL is a bad idea: https://github.com/sleevi/psl-problems https://github.com/sleevi/psl-problems and https://news.ycombinator.com/item?id=24441942 https://news.ycombinator.com/item?id=24441942 His recommendation is to as much as possible use the Same Origin Policy or if you must, a slightly weakened variant like ignoring port numbers. I suspect I'll make another comment elsewhere in this discussion that says more about the problems with that.
- captn3m0 6y agoAnother relevant read is the ICANN's research on the same: https://research.google/pubs/pub43821/ https://research.google/pubs/pub43821/ Title: SSAC Advisory on the Use of Static TLD / Suffix Lists Ultimately, it boils down to there not being any decent alternative. This is exactly the kind of hard problem that IETF should be tacking.
- johnbatch 6y agoAs far as I can tell Bitwarden is using that and pulling that info here: https://github.com/bitwarden/server/blob/0f1efdd18b879ccdf412fe742313ace75d0636c9/src/Icons/Resources/public_suffix_list.dat https://github.com/bitwarden/server/blob/0f1efdd18b879ccdf41...