3 ms·

Since this is a domain name concern, couldn't this be solved with some DNS record indicating that?

jub0bs 6y ago
AFAIK, there is no proposal to add a type of DNS record that would allow you to do that. And I don't think that this type of configuration should be done at the DNS level rather that at the HTTP one.
- chrismorgan 6y ago
  The public suffix list currently isn’t done at the DNS level or the HTTP level—rather it’s a hard-coded list that all the browsers copy. If I were redesigning whatever I felt like without backwards-compatibility concerns, things like TLS certificate authentication, HTTP Strict Transport Security and public suffix matters would certainly all be done through DNS. Not sure if anyone has ever seriously suggested shifting the PSL into DNS, but it seems a pretty reasonable goal to me. Certainly a few other things of this general style (that is, things you need to know before making the HTTPS connection) have been shifting into DNS, and a public suffix list is a better candidate than most because it’s a comparatively restricted set of people that will be using it, so they can cope with setting DNS records (that is, you’re not pushing everyone into implementing it, which would be completely doomed to failure).
Thorrez 6y ago
That's an interesting idea. One downside is that DNS isn't secure. So if someone can MITM your DNS (a coffee shop wifi for example), they could then set cookies on com . And if browsers erase cookies as soon as they see this DNS flag, the coffee shop could erase all your google.com cookies for example.
- colordrops 6y ago
  What about secure DNS?
  - Thorrez 6y ago
    There are multiple different types of secure DNS. DNS-over-HTTPS, DNS-over-TLS, DNSCrypt, DNSCurve, DNSSEC. Some of them don't even protect the client's traffic (you at a coffee shop). DNS-over-HTTPS (DoH) has been getting a lot of publicity lately since Chrome and Firefox started supporting it, but it's only activated sometimes. Many people don't like it: https://news.ycombinator.com/item?id=22414912 https://news.ycombinator.com/item?id=22414912 Another thing: even if your browser is using DoH 100% of the time, that's not good enough. Other things can use the public suffix list, such as a commandline go program that makes http requests[1]. If that program isn't using DoH then it's now vulnerable. Most programs use the DNS resolution capabilities provided by your operating system. I don't think any operating systems by default use DoH. [1] https://golang.org/pkg/net/http/cookiejar/#PublicSuffixList https://golang.org/pkg/net/http/cookiejar/#PublicSuffixList

AFAIK, there is no proposal to add a type of DNS record that would allow you to do that. And I don't think that this type of configuration should be done at the DNS level rather that at the HTTP one.

chrismorgan 6y ago
The public suffix list currently isn’t done at the DNS level or the HTTP level—rather it’s a hard-coded list that all the browsers copy. If I were redesigning whatever I felt like without backwards-compatibility concerns, things like TLS certificate authentication, HTTP Strict Transport Security and public suffix matters would certainly all be done through DNS. Not sure if anyone has ever seriously suggested shifting the PSL into DNS, but it seems a pretty reasonable goal to me. Certainly a few other things of this general style (that is, things you need to know before making the HTTPS connection) have been shifting into DNS, and a public suffix list is a better candidate than most because it’s a comparatively restricted set of people that will be using it, so they can cope with setting DNS records (that is, you’re not pushing everyone into implementing it, which would be completely doomed to failure).

Thorrez 6y ago

That's an interesting idea. One downside is that DNS isn't secure. So if someone can MITM your DNS (a coffee shop wifi for example), they could then set cookies on com . And if browsers erase cookies as soon as they see this DNS flag, the coffee shop could erase all your google.com cookies for example.

colordrops 6y ago
What about secure DNS?
- Thorrez 6y ago
  There are multiple different types of secure DNS. DNS-over-HTTPS, DNS-over-TLS, DNSCrypt, DNSCurve, DNSSEC. Some of them don't even protect the client's traffic (you at a coffee shop). DNS-over-HTTPS (DoH) has been getting a lot of publicity lately since Chrome and Firefox started supporting it, but it's only activated sometimes. Many people don't like it: https://news.ycombinator.com/item?id=22414912 https://news.ycombinator.com/item?id=22414912 Another thing: even if your browser is using DoH 100% of the time, that's not good enough. Other things can use the public suffix list, such as a commandline go program that makes http requests[1]. If that program isn't using DoH then it's now vulnerable. Most programs use the DNS resolution capabilities provided by your operating system. I don't think any operating systems by default use DoH. [1] https://golang.org/pkg/net/http/cookiejar/#PublicSuffixList https://golang.org/pkg/net/http/cookiejar/#PublicSuffixList