8 ms·
That time Verisign typo-squatted all of .com and .net
- quickthrower2 3y ago> They could do this because they controlled those from the registry side of things, and it was trivial to slam something that would make it resolve. Was this legal? If so what stopped them there, they could just hijack any domain?
- dharmab 3y agoICANN sent Verisign a strongly worded letter. Verisign stopped, but then sued ICANN and they settled a few years later.
- ajonit 3y agoVerisign sued ICANN! Why? What’s the full story?
- NL807 3y ago> VeriSign had sued ICANN, accusing the regulatory group that oversees the Internet's technical infrastructure of overstepping its contractual authority and dragging its feet on allowing VeriSign to offer new services such as a wait-list service and internationalized domain names. In the lawsuit, VeriSign claimed that ICANN stepped outside its charter by delaying the introduction of new VeriSign services, including its Site Finder service, which redirects requests for nonexistent Web addresses, and its ConsoliDate service, which manages multiple domains. VeriSign claimed that ICANN cost the company money because of its tactics Details here: https://www.computerworld.com/article/2560283/icann-revises-settlement-with-verisign.html https://www.computerworld.com/article/2560283/icann-revises-...
- JohnFen 3y agoI love how they characterize blatant abuse as "services".
- AndyMcConachie 3y agoHere is the ICANN archive of documents related to SiteFinder. https://archive.icann.org/en/topics/wildcard-history.html https://archive.icann.org/en/topics/wildcard-history.html In the end it resulted in what ICANN now calls the RSEP process. https://www.icann.org/resources/pages/rsep-2014-02-19-en https://www.icann.org/resources/pages/rsep-2014-02-19-en
- GoblinSlayer 3y agoTLD-insensitive request sounds like a nice feature: when you type cia.org and is redirected to cia.gov
- Sophira 3y agoExcept when you want to find out more about the x.org X11 server and get redirected to Twitter (x.com).
- zamadatix 3y agoWas there ever a time someone who wanted to find out more about xorg x11 knew (without already knowing about it) to just type "x.org" instead of "x11.org" or "xorg.org" or "xorg.com" or "xserver.org" and so on, finding non-existent responses or alternative groups who call themselves x? Collision and needing to "divine" the domain seem inherent to having a name system. Both this and the need for a TLD-insensitive lookup were solved by making the address bar also the search bar so people can use search engines to find new things instead of DNS.
- Joker_vD 3y agoOf course, the actual solution to this minor problem turned out to be the web search engines.
- GoblinSlayer 3y agoDo you trust them to not send you to a phishing site?
- Joker_vD 3y agoAbout as much as I trust the DNS to not send me to a phishing site.
- delfinom 3y agoAka, all TLDS become worthless and the guy with the most money wins?
- 55555 3y agoHow much do you think you'd make typo-squatting every .com and .net with parked domain ads? A billion dollars a year?
- fbdab103 3y agoAssuming you mean they get all URL typos for free, probably a lot less than days past. How many people can only ever Google things? Directly typing in a URL has to be a tiny minority of users.
- c0pium 3y agoEven less than you think, because even when they type in the URL it’s into a search bar which is smart enough to correct the typos. Edit: What’s really going to bake your noodle though, is that given all the issues with various kinds of URL squatting, they’re actually safer than those of us typing in the URL directly. Let’s hear it for my Dad, cybersecurity thought leader.
- inetknght 3y ago> they’re actually safer than those of us typing in the URL directly I heard there's something called a "bookmark" which makes it so you don't have to type in the URL though. But that's arcane magic.
- rblatz 3y agoNever got into bookmarks, seemed slower to have to grab a mouse and dig around to find the bookmark I was looking for, vs ctrl-t then the first few letters.
- blooalien 3y agoExcept that bookmarks are searchable, and in most browsers that search is a) available by hotkey, and b) offered as suggestions in the autosuggest of the address bar, so bookmarks tend to be useful to me at least.
- fbdab103 3y agoFrom another angle, presumably they had some excellent engineering on their site to be able to handle the enormous up tick in server load following the change. A note from Wikipedia[0] >According to the web traffic measurement company Alexa, in the year prior to the change verisign.com was around the 2,500th most popular website. In the weeks following the change, the site came into the top 20 most popular sites, and reached the top 10 in the aftermath of the change and surrounding controversy. [0] https://en.wikipedia.org/wiki/Site_Finder https://en.wikipedia.org/wiki/Site_Finder
- charcircuit 3y agoThis would not be possible with alternatives to DNS like namecoin and ENS.
- hanniabu 3y agoReally surprised the HN crowd isn't more into ENS, but then again they see the word blockchain and their bias makes them turn off any ability to think rationally
- LoganDark 3y agoThe bias is justified. I use crypto sometimes as a way to send money without linking it to my real identity, but that's all I use it for. I have no interest in how it's implemented, only that I have total privacy (at least with Monero).
- matheusmoreira 3y agoMore people should use monero!
- mjan22640 3y agoHow does that total privacy work?
- richardwhiuk 3y agoIt doesn't.
- immibis 3y agoAdvanced cryptography. OTOH: * Each transaction is signed by a "ring signature", where it's known that 1 of a set of 8 keys signed the transaction, but not which one. This is your actual input plus 7 other random inputs drawn from the same probability distribution as actual inputs. * Double-spending is prevented by a "key image" which is something mathematically related to your actual key (not sure how that's verified without knowing which key it is). Each key image can only be used once, or it's a double-spend. * Input amounts and output amounts have to balance using some kind of zero-knowledge proof.
- RockRobotRock 3y agoDNS from ISPs used to do this too, right?
- micw 3y agoRight. Telekom (germany) had this around 2010. It was called "Navigationshilfe" ("navigation aid"). At least there was an opt-out option. Edit: seems to have been there from 2009 till 2019 (!) after users took legal actions. See https://www.golem.de/news/t-online-navigationshilfe-telekom-beendet-dns-hijacking-nach-strafanzeige-1905-141370.html https://www.golem.de/news/t-online-navigationshilfe-telekom-... (german)
- iforgotpassword 3y agoArcor had this around 2004 iirc.
- oefrha 3y agoThis reminds me of another ISP scam. Around 2010, my ISP would occasionally inject pop-up ads into clear text HTTP pages. Apparently the solution was to call in a complaint. The customer support agent would act surprised (lol) and promise to investigate, and no ad would be delivered to the complaining customer afterwards.
- immibis 3y agoThis was one of the main reasons HTTPS took off. The other was Firesheep.
- pixl97 3y agoYea, everyone gets mad at Google for requiring https nearly everywhere, but outside of actual hackers, the ISPs were the cause of this. Redirecting you to an add page is terrible enough, ensuring that the ads on that page eventually served malware was the icing on the cake.
- bkallus 3y ago
- stilist 3y agoSee also ‘domain tasting’ (https://en.m.wikipedia.org/wiki/Domain_tasting https://en.m.wikipedia.org/wiki/Domain_tasting), where registrars would temporarily register non-existent domains when someone attempted to load them, showing a ‘for sale’ page to skim extra money off registrations.
- phero_cnstrcts 3y agoThinking of you godaddy.
- baryphonic 3y agoDid GoDaddy do this, too? I only remember Network Solutions. Incidentally, I was paranoid about this kind of front-running for years before I knew it had actually happened, and would just use whois from the terminal when searching for domain availability.
- euroderf 3y agoThere was also the excellent (and more capable) bw-whois, which was retired in 2019.
- stevehawk 3y agogodaddy 100% did it. i remember looking for a domain, taking a day to debate, they reporteded it registered and they 10x'd the domain price on me. When I reached out to ICANN about such a bs move they just came back with "GoDaddy isnt doing anything wrong." This was 10-15 years ago. That was the last time i registered anything with GoDaddy
- extraduder_ire 3y agoDoes any money change hands for this kind of front-running? If so, I think there's a good opportunity to either cost them a ton of money or drain whatever budget they allocate to this practice by baiting out registrations.
- Gud 3y agoTangentially, what are people using for DNS+e-mail today? Was a happy gandi customer but have migrated to Gandi for DNS and protonmail for e-mail since the Gandi takeover. I am really looking for a No Bullshit™ host for these things.
- VTimofeenko 3y agoBeen using Migadu for emails for the past 3 years. No complaints so far.
- Gud 3y agoThanks for the advice!
- stockhorn 3y agoHostpoint for DomainReg/DNS and Protonmail for Mail. But being located in switzerland that seems to be the obvious choice, right ;) ?
- Gud 3y agoNever heard of Hostpoint! Thanks for the tip!
- H8crilA 3y agoIndeed. No privacy/cryptography oriented company in Switzerland was ever a joint BND/CIA operation ;)
- pembrook 3y agoJust don’t use Hostpoint for email (have had many bad experiences). Stick to someone who specializes in email (ie. Gmail/Outlook/Zoho/Fastmail/etc).
- deleted 3y ago[deleted]
- cpach 3y agoIf you search in the search box I think you’ll be able to find lots of recommendations.
- ryan-c 3y ago> BIND (aka named, the occasional remote sudo implementation) Oh, goodness. dnsmasq got a feature to block site finder - the "bogus-nxdomain" option - which still exists and still mentions 64.94.110.11 in the documentation.
- qhwudbebd 3y ago"BIND (aka named, the occasional remote sudo implementation)" made me chuckle! I wonder if Paul Vixie still holds the record for the largest number of CERT advisories due to a single author?
- fanf2 3y agoIt’s a fair assessment of BIND4 and BIND8, but BIND9 has been a lot more solid. (The delegation-only feature was BIND9 only; I can’t remember if it has been removed yet.)
- ohashi 3y agoVerisign continues to run a monopoly on .COM/.NET with basically no checks or balances to its power. ICANN has effectively surrendered to it. A significant amount of ICANN's budget is coming from Verisign. ICANN refuses to exercise any oversight, it's likely an example of regulatory capture at this point. Verisign is going to push every possible way to extract more money from .COM/.NET monopoly. They maximize price increases at every opportunity on their contracts (which has automatic renewal and no competition). For what? No added value to customers or the ecosystem as a whole. SiteFinder was just one of many moves in a long series of bad for everyone but Verisign moves. Remember when .ORG had its price caps removed and then private equity tried to buy it? Guess where a lot of that backing came from...
- wbl 3y agoRichard Barnes wanted ISOC to get an endowment by selling .ORG. having .ORG is great for the nonprofits but really isn't something ISOC can leverage to support IETF etc. I believe the registry contracts are bid out every few years. However it's a very difficult business with fixed prices that depends on lots of operational efficiencies.
- ohashi 3y agoHaving .ORG was the endowment. Selling off something they don't/shouldn't 'own' is bullshit. They were granted an endowment to manage .ORG to use the profits to support IETF. They simply outsource the backend and collect a large profit. It's not a difficult business at all. The margins are insanely good in fact. They're doing at least 60% if not closer to 90% I suspect on the actual operations side if they competitively bid out their backend. Registry contracts aren't bid out every few years for the most part, that's a giant problem. Why Verisign has a monopoly on com/net.
- Spivak 3y agoI don't really understand why people care specifically about .com when they're still one of the cheapest TLDs you can buy. Like if you wanted to pin this on Verisign specifically you're gonna have to explain why every other domain costs about the same or more. Like tech darlings .io=$71, .tv=$32, .me=$25. Even the worst domain ever .info is $23.
- gadders 3y agoThe whirring sound was the late, great, Jon Postel spinning in his grave.
- sideproject 3y ago[dead]
- 1vuio0pswjnm7 3y agoSiteFinder https://patentimages.storage.googleapis.com/pdfs/US7337910.pdf https://patentimages.storage.googleapis.com/pdfs/US7337910.p...