8 ms·

>(This isn't a particularly idle concern. Amazingly Microsoft once got a court to let it take operational control of the domain no-ip.org — that is, to actually

by jdong 4y ago

>(This isn't a particularly idle concern. Amazingly Microsoft once got a court to let it take operational control of the domain no-ip.org — that is, to actually hijack the domain — a dynamic DNS service used by countless people — simply because one user was apparently using it for malware-related purposes.) What a dishonest take. Microsoft didn't wasn't granted this court order because there was one bad no-ip user, Microsoft was granted the court order because there was a bad no-ip user that no-ip wouldn't take action against. Oh, and it wasn't one bad user. It was 22000 different hostnames.

Fatnino 4y ago
I have a domain on no-ip.org I remember when this happened and I was trying to debug why I couldn't reach my home server.
Rygian 4y ago
That's like your landlord handing the keys to your condo to the bully upstairs because you have a cockroach problem.
- dotancohen 4y ago
  More like your landlord handing the keys to your condo to the bully upstairs because somebody else on your floor has a cockroach problem.
  - RobotToaster 4y ago
    Or to be more precise, the keys to every condo in the building.
- rosnd 4y ago
  It's like a judge ordering you to hand over your keys to the person living underneath because you have a water leak you refuse to fix. Perhaps the water leak was caused by someone else, but it's still in your apartment.
  - Dylan16807 4y ago
    1. That would still be ridiculous. 2. The water leak isn't actually in the apartment if we're keeping this accurate to domains. Maybe the only phone the plumber will listen to is in the apartment. 3. As someone else already said, the judge is handing over the keys to the entire building.
    - rosnd 4y ago
      >1. That would still be ridiculous. How would it be ridiculous? A water leak in your flat is causing damage to the flat below yours, it's your duty to address this. If you do not address this, someone will in fact go to court and take control of your flat. This is something that happens all the time in cases where compliance with specific performance orders seems unlikely.
hlandau 4y ago
Author here. If the sought action of the court case, and the outcome were, "the domain were taken down" that would be one thing. Domains get suspended by court cases all the time, that's not the issue. What makes the no-ip.org case extraordinary is that Microsoft a) persuaded the court that the domain was being used for malware, and then b) persuaded the court that because of this, rather than doing something normal like compelling its operator to take down the afflicted subdomains, or failing that compelling a third party to suspend the domain, that they should be allowed to take over DNS service for the domain. Microsoft is not the law and they have no special legal status. If a domain is being used for cybercrime it's one thing, it doesn't mean any random party should get to walk into court, complain about it, and then offer to "solve" the issue by randomly appointing itself DNS provider. Microsoft essentially hijacked and MitM'd the domain via court order, again demonstrating that the registries/registrars will always be a risk here. The result I might add was a massive outage for a massive number of innocent no-ip.org users.
- huggingmouth 4y ago
  I think the fundamental issue here is that the court actually granted Microsoft's rediculus request. The only valid ruling here was for the court to order the suspension of the domain. Seeing that Microsoft are an unrelated third-party, what was the judge's reasoning for granting them specifically ownership of the defendant's property? Wouldn't it have made more sense to assign ownership to a government organization instead? Did Microsoft reimburse the domain owner the value of the domain or did they just steal it without payment?
  - hlandau 4y ago
    It all got reversed eventually after massive negative press coverage. I don't think Microsoft took "ownership" of the domain, but simply got the court to make them the nameservers, though I may be wrong. I do feel like the only way this request was granted was due to total ignorance on the part of the court of anything about how the internet works.
    - rdxm 4y ago
huggingmouth 4y ago
Regardless of whether you think it's dishinest or not, his point still stands: tls mitm is not and cannot be mitigated via DNS.
- tptacek 4y ago
  Nor with DNSSEC: the same government that gave Microsoft control over this zone has de jure control over DNSSEC key management for that zone.
  - xorcist 4y ago
    This control is indistinguishable from a domain transfer, so this is trivially true. Zones not under their control, however, are not vulnerable to this. So compared to the current system it would be an improvement.
  - dane-pgp 4y ago
    DNSSEC doesn't protect you against the American government if you have a .org domain, but I doubt an American court could give Microsoft control over a domain registered under a ccTLD like .de or .ru or .za for example. I suspect Microsoft would also have trouble taking control of a domain registered under a gTLD run by a company based outside the US, but it would be interesting to see how the agreements between the gTLDs and ICANN would work out in practice.
    - rosnd 4y ago
      >DNSSEC doesn't protect you against the American government if you have a .org domain, but I doubt an American court could give Microsoft control over a domain registered under a ccTLD like .de or .ru or .za for example. What? Obviously they could. ICANN is subject to US law.
    - dcomp 4y ago
      Technically they could force root nameservers (based in the US) to intercept/proxy the whole gtld. So all except n (netnod (EU)) and i (WIDE (JP))
throwaway0x7E6 4y ago
so fucking what? it's an equivalent of a corporation invading and seizing control of an entire country because some people living there are doing it harm
- rosnd 4y ago
  - throwaway0x7E6 4y ago
    [flagged]

by jdong 4y ago

Fatnino 4y ago

I have a domain on no-ip.org I remember when this happened and I was trying to debug why I couldn't reach my home server.

Rygian 4y ago

That's like your landlord handing the keys to your condo to the bully upstairs because you have a cockroach problem.

dotancohen 4y ago
More like your landlord handing the keys to your condo to the bully upstairs because somebody else on your floor has a cockroach problem.
- RobotToaster 4y ago
  Or to be more precise, the keys to every condo in the building.
rosnd 4y ago
It's like a judge ordering you to hand over your keys to the person living underneath because you have a water leak you refuse to fix. Perhaps the water leak was caused by someone else, but it's still in your apartment.
- Dylan16807 4y ago
  1. That would still be ridiculous. 2. The water leak isn't actually in the apartment if we're keeping this accurate to domains. Maybe the only phone the plumber will listen to is in the apartment. 3. As someone else already said, the judge is handing over the keys to the entire building.
  - rosnd 4y ago
    >1. That would still be ridiculous. How would it be ridiculous? A water leak in your flat is causing damage to the flat below yours, it's your duty to address this. If you do not address this, someone will in fact go to court and take control of your flat. This is something that happens all the time in cases where compliance with specific performance orders seems unlikely.

hlandau 4y ago

Author here. If the sought action of the court case, and the outcome were, "the domain were taken down" that would be one thing. Domains get suspended by court cases all the time, that's not the issue. What makes the no-ip.org case extraordinary is that Microsoft a) persuaded the court that the domain was being used for malware, and then b) persuaded the court that because of this, rather than doing something normal like compelling its operator to take down the afflicted subdomains, or failing that compelling a third party to suspend the domain, that they should be allowed to take over DNS service for the domain. Microsoft is not the law and they have no special legal status. If a domain is being used for cybercrime it's one thing, it doesn't mean any random party should get to walk into court, complain about it, and then offer to "solve" the issue by randomly appointing itself DNS provider. Microsoft essentially hijacked and MitM'd the domain via court order, again demonstrating that the registries/registrars will always be a risk here. The result I might add was a massive outage for a massive number of innocent no-ip.org users.

huggingmouth 4y ago
I think the fundamental issue here is that the court actually granted Microsoft's rediculus request. The only valid ruling here was for the court to order the suspension of the domain. Seeing that Microsoft are an unrelated third-party, what was the judge's reasoning for granting them specifically ownership of the defendant's property? Wouldn't it have made more sense to assign ownership to a government organization instead? Did Microsoft reimburse the domain owner the value of the domain or did they just steal it without payment?
- hlandau 4y ago
  It all got reversed eventually after massive negative press coverage. I don't think Microsoft took "ownership" of the domain, but simply got the court to make them the nameservers, though I may be wrong. I do feel like the only way this request was granted was due to total ignorance on the part of the court of anything about how the internet works.
  - rdxm 4y ago

huggingmouth 4y ago

Regardless of whether you think it's dishinest or not, his point still stands: tls mitm is not and cannot be mitigated via DNS.

tptacek 4y ago
Nor with DNSSEC: the same government that gave Microsoft control over this zone has de jure control over DNSSEC key management for that zone.
- xorcist 4y ago
  This control is indistinguishable from a domain transfer, so this is trivially true. Zones not under their control, however, are not vulnerable to this. So compared to the current system it would be an improvement.
- dane-pgp 4y ago
  DNSSEC doesn't protect you against the American government if you have a .org domain, but I doubt an American court could give Microsoft control over a domain registered under a ccTLD like .de or .ru or .za for example. I suspect Microsoft would also have trouble taking control of a domain registered under a gTLD run by a company based outside the US, but it would be interesting to see how the agreements between the gTLDs and ICANN would work out in practice.
  - rosnd 4y ago
    >DNSSEC doesn't protect you against the American government if you have a .org domain, but I doubt an American court could give Microsoft control over a domain registered under a ccTLD like .de or .ru or .za for example. What? Obviously they could. ICANN is subject to US law.
  - dcomp 4y ago
    Technically they could force root nameservers (based in the US) to intercept/proxy the whole gtld. So all except n (netnod (EU)) and i (WIDE (JP))

throwaway0x7E6 4y ago

so fucking what? it's an equivalent of a corporation invading and seizing control of an entire country because some people living there are doing it harm

rosnd 4y ago
- throwaway0x7E6 4y ago
  [flagged]