6 ms·

> The domain assets-origin.production.govuk.digital "looks" very much like a phishing url, even if it's internal .digital is a real TLD, and govuk.digital is a

> The domain assets-origin.production.govuk.digital "looks" very much like a phishing url, even if it's internal .digital is a real TLD, and govuk.digital is an actual domain, registered by "Government Digital Service" (created 2017-07-14T14:17:30Z) although the registrant's details are redacted "for privacy". Is this domain really registered to some part of uk.gov? ...or is this some bad actor/squatter who found out about the internal naming and snapped up the matching public domain? Q: Shouldn't gov.uk just stick to domains under .gov.uk?(!) Would make it easier to work out who's actually gov.uk and who's merely pretending :)

mkl95 4y ago
> Q: Shouldn't gov.uk just stick to domains under .gov.uk?(!) Would make it easier to work out who's actually gov.uk and who's merely pretending :) The main reason to buy those domains is to spend as little money as possible. Someone at gov.uk is a cheapskate or works with a really limited budget.
- IndigoIncognito 4y ago
  Limited budget, the UK public sector funding right now is atrocious, even in IT
  - robertlagrant 4y ago
    Not at this level. There are still roomfulls of people that cost more than the amount of money they're deciding whether or not to spend.
- danw1979 4y ago
  Aren’t gov.uk domains transferred internally within UK government depts at zero cost ? I guess there’s got to be some incentive for teams to not register hundreds of subdomains, but if they are turning to 3rd party TLDs to host government assets, I’d say something has gone wrong.
  - mkl95 4y ago
    If the process is complex (write a detailed ticket, wait for feedback, get some manager's nod, etc.), buying a domain and deploying it yourself is orders of magnitude cheaper and faster, and can be the only way to test something in an env that resembles prod. I have done it myself for non critical stuff, although I'm not sure I would at some government org.
    - logifail 4y ago
      > If the process is complex (write a detailed ticket, wait for feedback, get some manager's nod, etc.), buying a domain and deploying it yourself is orders of magnitude cheaper and faster [..] Isn't this basically the very definition of "shadow IT"? Then you find that some prod[-ish] service relies on an external provider that's not listed as a provider in any of your org's financial systems, is paid by some random internal person's credit card and expensed back ... then that internal person leaves, and N weeks/months later all hell breaks loose when your service falls over and no-one knows why.
      - mkl95 4y ago
        Most non SOC certified companies have some non auditable processes, the ubiquitous one being deploying stuff manually / non reproducibly. Whether something is "shadow IT" will depend on who you ask. Personally I have never deployed something to prod that way (I did it for some lower envs), but it's something I've seen people do at every single place I've worked. And your last paragraph is 100% true in my experience.
- selfhoster11 4y ago
  This might sound a bit crazy, but... the UK government is in sole control of .gov.uk, right? They shouldn't have issues issuing themselves with as many subdomains as needed. For free, or for symbolic prices.
  - ldjb 4y ago
    Sort of. The UK Government (specifically the Cabinet Office) manages various aspects of the *.gov.uk space, but .gov.uk domains can be registered not only by the UK Government, but also local governments and other public sector organisations. .gov.uk domains are registered through commercial registrars (who charge a fee), much like .co.uk domain names. The main difference being that you need to be an eligible organisation to register a .gov.uk domain name.
- scrollaway 4y ago
  Absolutely untrue. The main reason these domains get bought is because it’s simpler. There are likely procedures in place and security checks and people involved in gov.uk domain control, that are a non issue if the team owns the tld, which makes internal testing easier.
andylynch 4y ago
Looks like they had a misconfiguration slip out; it was an internal domain but somehow began being used to serve favicons.
- logifail 4y ago
  > it was an internal domain That may also be (tangentially) true, but someone also paid _actual_ money to register the _actual_ .digital domain. Was this 'someone' really uk.gov? If so, why?
  - kevingadd 4y ago
    If you're going to use a domain internally, you should really own it. Otherwise someone else could buy it and potentially hijack requests.
    - logifail 4y ago
      So why is using .govuk.digital for internal services - while still having to purchase and renew the actual govuk.digital domain - preferable to, say, setting everything up under .internal.gov.uk?
      - dndvr 4y ago
        - To reduce the attack surface In the event of site with a *.gov.uk subdomain getting compromised at least it won't now be able to steal auth cookies for internal services - to keep test/stage as faithful a copy of prod as possible they will have a totally separate but the same DNS set up/CDN set up/ load balancing etc. Theoretically the only difference would need to be one routing rule rather than stuff that might start creating edge case bugs with certs/cookies etc where there are different numbers of segments in domains. Also allows for more certainty/confidence when something is tested in a lower environment that it will work when promoted to prod
      - kevingadd 4y ago
        It's good security practice to have separate sandboxes/domains for various types of services so it's harder for people to pivot from one to another in the event of an exploit. Similar to having a different domain for internal services, if you host user content on your site you should host all that user generated content on a different domain so it can't access your cookies etc.
mananaysiempre 4y ago
> Shouldn't gov.uk just stick to domains under .gov.uk? TFA says this was the intention, and the govuk.digital reference never worked outside the internal network (the subdomain in question does resolve right now, but the pointed-to host seems to be firewalled). That alone is much better than I’ve seen banks do. Given that *.production.govuk.digital is presumably accompanied by *.staging.govuk.digital or similar, I can see why they took out a separate domain for internal purposes, e.g. so that breaking DNS for it does not immediately put the whole of public-facing gov.uk on fire, or so that the CDN can pick up backend IP changes without modifications to the gov.uk DNS zone, or for some other infrastructural reason. It’s not like domains are expensive, and this one honestly looks like it might have been left over from the time they were rolling out the whole thing. (TIL you can set favicon URLs for non-HTML documents: apparently putting rel="shortcut icon" in the HTTP Link header should work? Although gov.uk is not doing that right now.)
samwillis 4y ago
My guess is that the "UK Government Digital Service", who run most central government it services, use govuk.digital as a top level domain for all internal services. I believe it's fairly common to have a TLD that is only used for internal addresses, it helps to ensure they are only routed internally and not accidentally exposed. Using a "real" TLD also ensures you own the namespace and it can't be accidentally used by a third party. If they were to use an *.gov.uk domain for internal services there is a higher chance that someone would inadvertently expose it to the internet. https://www.gov.uk/government/organisations/government-digital-service https://www.gov.uk/government/organisations/government-digit...
erinaceousjones 4y ago
> Shouldn't gov.uk just stick to domains under .gov.uk?(!) Would make it easier to work out who's actually gov.uk and who's merely pretending :) Much smaller scale example: Where I work, our production web app is at `<subdomain>.<charity>.ac.uk`. DNS and SSL certs are managed centrally by IT. We open a support ticket, someone in IT gets it done. DNS entries are usually done within a few hours, but they like to purchase SSL certs in batches so if we need a cert for a new domain/subdomain it could take a few days or weeks. It's useful for us to spin up multiple different dev/test/staging copies of our app, which are otherwise nearly identical to production in terms of how the infrastructure is set up. These are short-lived and used for internal user acceptance testing before we roll out changes to the live app - they're only accessible on the local network (so, via VPN or onsite), but we want to reduce friction to our users, as the ones doing the acceptance testing are domain experts (i.e. scientists, researchers, electrical engineers) but don't want to be tinkering around with software dev stuff like "editing /etc/hosts" and "accepting self signed SSL certificates". We don't want to wait around for a whole sprint length's amount of time waiting on new temp subdomains when we've got new stuff to demo to people. It's a lot easier to just claim a domain name of our own (i.e. `.ga` and `.ml` are free) and set them up with external DNS management (have used cloudflare before, because it's easy to do letsencrypt DNS challenge method with it), and use letsencrypt for the SSL certs. We could theoretically ask IT to let us manage the DNS ourselves for everything under `<subdomain>.<charity>.ac.uk`, i.e. they point that subdomain to an `NS` record to an authoritative DNS server that we run ourselves, and we could ask them for some wildcard certificates so we could do stuff like `staging-env-123.<subdomain>.<charity>.ac.uk`. But our team is small, and we don't really _want_ to manage yet another service (our own DNS)* and have it adequately locked down to appease "cyber essentials" and so forth :-) and neither do IT want to defer DNS to "knowledgeable, but still users" users of the corporate network. And wildcard certificates are iffy from a security standpoint also. *In practise this'd be letting kubernetes components manage it, but k8s is so bloody brittle and oh god I cannot keep up with all of this devops stuff there's like 5 of us stop making us run servers on top of servers. It would not surprise me if there's similar gatekeeping of .gov.uk subdomains and SSL certs, necessary-for-security bureaucracy given their high profile, which slows down the deployment of temp. staging / "internal user acceptance testing" environments, and so the internal dev teams at some point went "fuck it, we'll buy a new domain ourselves" and someone paid for the govuk.digital domain using a Government Purchase Card and claimed it on the relevant Project Code. EDIT: Reading comments about buy-your-own-domain being "shadow IT". Salient points about random people in the org paying for third-party services with a company credit card and then leaving. It's important to get in the "bus factor" mindset with this stuff, e.g. "if I got hit by a bus today, would anything fuck up in work if I wasn't there to remember login details?". Make sure logins for things are shared with the whole team in a secure way, make use of tools which support organisation accounts, have a shared mailbox etc.... oh and make sure the companies/services gets registered as a supplier with finance.

mkl95 4y ago

> Q: Shouldn't gov.uk just stick to domains under .gov.uk?(!) Would make it easier to work out who's actually gov.uk and who's merely pretending :) The main reason to buy those domains is to spend as little money as possible. Someone at gov.uk is a cheapskate or works with a really limited budget.

IndigoIncognito 4y ago
Limited budget, the UK public sector funding right now is atrocious, even in IT
- robertlagrant 4y ago
  Not at this level. There are still roomfulls of people that cost more than the amount of money they're deciding whether or not to spend.
danw1979 4y ago
Aren’t gov.uk domains transferred internally within UK government depts at zero cost ? I guess there’s got to be some incentive for teams to not register hundreds of subdomains, but if they are turning to 3rd party TLDs to host government assets, I’d say something has gone wrong.
- mkl95 4y ago
  If the process is complex (write a detailed ticket, wait for feedback, get some manager's nod, etc.), buying a domain and deploying it yourself is orders of magnitude cheaper and faster, and can be the only way to test something in an env that resembles prod. I have done it myself for non critical stuff, although I'm not sure I would at some government org.
  - logifail 4y ago
    > If the process is complex (write a detailed ticket, wait for feedback, get some manager's nod, etc.), buying a domain and deploying it yourself is orders of magnitude cheaper and faster [..] Isn't this basically the very definition of "shadow IT"? Then you find that some prod[-ish] service relies on an external provider that's not listed as a provider in any of your org's financial systems, is paid by some random internal person's credit card and expensed back ... then that internal person leaves, and N weeks/months later all hell breaks loose when your service falls over and no-one knows why.
    - mkl95 4y ago
      Most non SOC certified companies have some non auditable processes, the ubiquitous one being deploying stuff manually / non reproducibly. Whether something is "shadow IT" will depend on who you ask. Personally I have never deployed something to prod that way (I did it for some lower envs), but it's something I've seen people do at every single place I've worked. And your last paragraph is 100% true in my experience.
selfhoster11 4y ago
This might sound a bit crazy, but... the UK government is in sole control of .gov.uk, right? They shouldn't have issues issuing themselves with as many subdomains as needed. For free, or for symbolic prices.
- ldjb 4y ago
  Sort of. The UK Government (specifically the Cabinet Office) manages various aspects of the *.gov.uk space, but .gov.uk domains can be registered not only by the UK Government, but also local governments and other public sector organisations. .gov.uk domains are registered through commercial registrars (who charge a fee), much like .co.uk domain names. The main difference being that you need to be an eligible organisation to register a .gov.uk domain name.
scrollaway 4y ago
Absolutely untrue. The main reason these domains get bought is because it’s simpler. There are likely procedures in place and security checks and people involved in gov.uk domain control, that are a non issue if the team owns the tld, which makes internal testing easier.

andylynch 4y ago

Looks like they had a misconfiguration slip out; it was an internal domain but somehow began being used to serve favicons.

logifail 4y ago
> it was an internal domain That may also be (tangentially) true, but someone also paid _actual_ money to register the _actual_ .digital domain. Was this 'someone' really uk.gov? If so, why?
- kevingadd 4y ago
  If you're going to use a domain internally, you should really own it. Otherwise someone else could buy it and potentially hijack requests.
  - logifail 4y ago
    So why is using .govuk.digital for internal services - while still having to purchase and renew the actual govuk.digital domain - preferable to, say, setting everything up under .internal.gov.uk?
    - dndvr 4y ago
      - To reduce the attack surface In the event of site with a *.gov.uk subdomain getting compromised at least it won't now be able to steal auth cookies for internal services - to keep test/stage as faithful a copy of prod as possible they will have a totally separate but the same DNS set up/CDN set up/ load balancing etc. Theoretically the only difference would need to be one routing rule rather than stuff that might start creating edge case bugs with certs/cookies etc where there are different numbers of segments in domains. Also allows for more certainty/confidence when something is tested in a lower environment that it will work when promoted to prod
    - kevingadd 4y ago
      It's good security practice to have separate sandboxes/domains for various types of services so it's harder for people to pivot from one to another in the event of an exploit. Similar to having a different domain for internal services, if you host user content on your site you should host all that user generated content on a different domain so it can't access your cookies etc.

mananaysiempre 4y ago

> Shouldn't gov.uk just stick to domains under .gov.uk? TFA says this was the intention, and the govuk.digital reference never worked outside the internal network (the subdomain in question does resolve right now, but the pointed-to host seems to be firewalled). That alone is much better than I’ve seen banks do. Given that *.production.govuk.digital is presumably accompanied by *.staging.govuk.digital or similar, I can see why they took out a separate domain for internal purposes, e.g. so that breaking DNS for it does not immediately put the whole of public-facing gov.uk on fire, or so that the CDN can pick up backend IP changes without modifications to the gov.uk DNS zone, or for some other infrastructural reason. It’s not like domains are expensive, and this one honestly looks like it might have been left over from the time they were rolling out the whole thing. (TIL you can set favicon URLs for non-HTML documents: apparently putting rel="shortcut icon" in the HTTP Link header should work? Although gov.uk is not doing that right now.)

samwillis 4y ago

My guess is that the "UK Government Digital Service", who run most central government it services, use govuk.digital as a top level domain for all internal services. I believe it's fairly common to have a TLD that is only used for internal addresses, it helps to ensure they are only routed internally and not accidentally exposed. Using a "real" TLD also ensures you own the namespace and it can't be accidentally used by a third party. If they were to use an *.gov.uk domain for internal services there is a higher chance that someone would inadvertently expose it to the internet. https://www.gov.uk/government/organisations/government-digital-service https://www.gov.uk/government/organisations/government-digit...

erinaceousjones 4y ago

> Shouldn't gov.uk just stick to domains under .gov.uk?(!) Would make it easier to work out who's actually gov.uk and who's merely pretending :) Much smaller scale example: Where I work, our production web app is at `<subdomain>.<charity>.ac.uk`. DNS and SSL certs are managed centrally by IT. We open a support ticket, someone in IT gets it done. DNS entries are usually done within a few hours, but they like to purchase SSL certs in batches so if we need a cert for a new domain/subdomain it could take a few days or weeks. It's useful for us to spin up multiple different dev/test/staging copies of our app, which are otherwise nearly identical to production in terms of how the infrastructure is set up. These are short-lived and used for internal user acceptance testing before we roll out changes to the live app - they're only accessible on the local network (so, via VPN or onsite), but we want to reduce friction to our users, as the ones doing the acceptance testing are domain experts (i.e. scientists, researchers, electrical engineers) but don't want to be tinkering around with software dev stuff like "editing /etc/hosts" and "accepting self signed SSL certificates". We don't want to wait around for a whole sprint length's amount of time waiting on new temp subdomains when we've got new stuff to demo to people. It's a lot easier to just claim a domain name of our own (i.e. `.ga` and `.ml` are free) and set them up with external DNS management (have used cloudflare before, because it's easy to do letsencrypt DNS challenge method with it), and use letsencrypt for the SSL certs. We could theoretically ask IT to let us manage the DNS ourselves for everything under `<subdomain>.<charity>.ac.uk`, i.e. they point that subdomain to an `NS` record to an authoritative DNS server that we run ourselves, and we could ask them for some wildcard certificates so we could do stuff like `staging-env-123.<subdomain>.<charity>.ac.uk`. But our team is small, and we don't really _want_ to manage yet another service (our own DNS)* and have it adequately locked down to appease "cyber essentials" and so forth :-) and neither do IT want to defer DNS to "knowledgeable, but still users" users of the corporate network. And wildcard certificates are iffy from a security standpoint also. *In practise this'd be letting kubernetes components manage it, but k8s is so bloody brittle and oh god I cannot keep up with all of this devops stuff there's like 5 of us stop making us run servers on top of servers. It would not surprise me if there's similar gatekeeping of .gov.uk subdomains and SSL certs, necessary-for-security bureaucracy given their high profile, which slows down the deployment of temp. staging / "internal user acceptance testing" environments, and so the internal dev teams at some point went "fuck it, we'll buy a new domain ourselves" and someone paid for the govuk.digital domain using a Government Purchase Card and claimed it on the relevant Project Code. EDIT: Reading comments about buy-your-own-domain being "shadow IT". Salient points about random people in the org paying for third-party services with a company credit card and then leaving. It's important to get in the "bus factor" mindset with this stuff, e.g. "if I got hit by a bus today, would anything fuck up in work if I wasn't there to remember login details?". Make sure logins for things are shared with the whole team in a secure way, make use of tools which support organisation accounts, have a shared mailbox etc.... oh and make sure the companies/services gets registered as a supplier with finance.