3 ms·

"The data we’re interested in are basically just DNS errors: NXD – Non Existent Domain - the domain that a user entered that resulted in a DNS error. [...]" W

by ro_bit 5y ago

"The data we’re interested in are basically just DNS errors: NXD – Non Existent Domain - the domain that a user entered that resulted in a DNS error. [...]" What's the catch here? Are they making the extension query invalid names like userspersonallyidentifiableinformation.com to exfiltrate data from NXDOMAINs?

axiosgunnar 5y ago
Perhaps they want to snatch up the domain names people are trying out and then sell them to them with a margin?
uo21tp5hoyg 5y ago
If it's malicious it could be to buy up commonly typo'd domain names
lovasoa 5y ago
Maybe they just want to buy these domains. I imagine that available domains people query a lot can be resold for a lot of money. Or they are into typosquatting.
blincoln 5y ago
A few possibilities I can think of: - Trying to figure out commonly-mistyped domain names in order to buy them for ad placement. - Trying to obtain confidential information that's accidentally pasted into the address bar. - Trying to obtain internal domain names that someone tries to access while disconnected from a VPN or just physically outside the office. - (If the extension could catch all non-existent domain errors, not just ones from typing in the address bar) attempting to find abandoned domains that are still referenced by JavaScript and whatnot in order to buy them. This could potentially be used to inject content (probably ads) into the systems that still reference those domains. - Legitimate research into how users mistype domain names, maybe to figure out how to think of names that are less likely to be mistyped. I don't know offhand if modern browsers also do DNS lookups as the user is typing characters into the address bar, or just do Google/Bing/whatever queries as the user is typing. I know they do the latter (i.e. typing 'news.ycombinator.com' into the address bar will send queries for 'n', 'ne', 'new', 'news', and so on to the search engine), but I don't know if they're also still doing DNS lookups at each step as well. If they are, and the extension could capture all of those, then that could be an interesting way to collect users' search queries.
lucb1e 5y ago
Answered in https://news.ycombinator.com/item?id=27328642 https://news.ycombinator.com/item?id=27328642

by ro_bit 5y ago

axiosgunnar 5y ago

Perhaps they want to snatch up the domain names people are trying out and then sell them to them with a margin?

uo21tp5hoyg 5y ago

If it's malicious it could be to buy up commonly typo'd domain names

lovasoa 5y ago

Maybe they just want to buy these domains. I imagine that available domains people query a lot can be resold for a lot of money. Or they are into typosquatting.

blincoln 5y ago

A few possibilities I can think of: - Trying to figure out commonly-mistyped domain names in order to buy them for ad placement. - Trying to obtain confidential information that's accidentally pasted into the address bar. - Trying to obtain internal domain names that someone tries to access while disconnected from a VPN or just physically outside the office. - (If the extension could catch all non-existent domain errors, not just ones from typing in the address bar) attempting to find abandoned domains that are still referenced by JavaScript and whatnot in order to buy them. This could potentially be used to inject content (probably ads) into the systems that still reference those domains. - Legitimate research into how users mistype domain names, maybe to figure out how to think of names that are less likely to be mistyped. I don't know offhand if modern browsers also do DNS lookups as the user is typing characters into the address bar, or just do Google/Bing/whatever queries as the user is typing. I know they do the latter (i.e. typing 'news.ycombinator.com' into the address bar will send queries for 'n', 'ne', 'new', 'news', and so on to the search engine), but I don't know if they're also still doing DNS lookups at each step as well. If they are, and the extension could capture all of those, then that could be an interesting way to collect users' search queries.

lucb1e 5y ago

Answered in https://news.ycombinator.com/item?id=27328642 https://news.ycombinator.com/item?id=27328642