3 ms·

As long as companies operate their software on domains all over the place they are actively hurting security. How do you explain to normal people that fbsbx.co

As long as companies operate their software on domains all over the place they are actively hurting security. How do you explain to normal people that fbsbx.com is a totally legit facebook site they have nothing to worry about, while fbsby.com and fbsbz.com might be dangerous. We put so much effort into keeping up domain trust and all this hard work is for nothing as long as this goes on.

ehPReth 3y ago
I have the exact same note with my government. They moved everything to one unified government.example site, all departments on it etc. Quite nice. Then, over the years, little ‘marketing’/‘awareness’/‘speciality’ sites like governmentdrivesafe.example or governmentvaccines.example, or even governmentgetabusehelp.example (it’s actually a similar initialsm, but it’s a place with resources for people to get help), etc started popping up. So many of these and all that work they did to have one ‘front’ or trusted place to visit is gone? Anyone can register a government<something>.example (they chose a public TLD)… just baffles me honestly. New content from department still appears on their “flagship” site, but also these one offs pop up as well. They also have, and use, a url shortening service on their main domain (e.g. government.example/{taxes,vehicles,covid} redirects to the longer link on government.example) but instead some departments opt to register domains instead. At least in FB’s case those might not be for their user’s use (the obscure fb<xyz>.example domains>)? Has anyone else seen something like this in their local area?
- frontalier 3y ago
  it's .ch right?
- Moru 3y ago
  The worst part is when they buy a custom domain and then abandons it after a few years. And then someone buys the domain to host a scam instead.
vasco 3y ago
Most of these a user wouldn't ever see even as a URL temporarily in a redirect, most of these you'd only see if you're inspecting traffic. In fact you can see they purchased a bunch of typos of instagram for example, presumably to reduce user exposure to scams on similar domains.
snailmailman 3y ago
The first time I got an email from Facebook I thought it was a scam- because they don’t send their emails from Facebook.com they send them all through Facebookmail.com Their help article about this seems to imply that they also use Metamail.com now, but checking my email I am seeing only seeing emails from addresses ending with @email.meta.com
- nojs 3y ago
  Not sure about Meta but a lot of companies do this to preserve the domain reputation of their main domain, since sending mass or automated emails may degrade it and lead to things being marked as spam.
ororroro 3y ago
It gets worse, "youtube.com.fb.me" and similar are also in this list.
jowea 3y ago
Can someone explain why can't they just create a new subdomain for each of their stuff? Is it because it's easier to deal with the registrar and pay instead of the internal bureaucracy to assign a domain name? Is there some technical reason? I know that user-generated content may end up on separate domain for cookie reasons but is there anything else?
- nonrandomstring 3y ago
  I wrote about it a few days ago in response to Troy Hunt's FedEx post [0]. To answer your question, one of the reasons they don't use their own subdomains is that it's cheaper to delegate lots of support services to third party providers. Another is to avoid "polluting" their domains in the eyes of various reputation filters. [0] https://cybershow.uk/blog/posts/scamicry https://cybershow.uk/blog/posts/scamicry
geor9e 3y ago
Normal people just see facebook.com in their browser URL box and will never be dealing with the hundreds of different CDN domains it might be pulling from anyway, unless they're inspecting the HTML in dev tools.

ehPReth 3y ago

I have the exact same note with my government. They moved everything to one unified government.example site, all departments on it etc. Quite nice. Then, over the years, little ‘marketing’/‘awareness’/‘speciality’ sites like governmentdrivesafe.example or governmentvaccines.example, or even governmentgetabusehelp.example (it’s actually a similar initialsm, but it’s a place with resources for people to get help), etc started popping up. So many of these and all that work they did to have one ‘front’ or trusted place to visit is gone? Anyone can register a government<something>.example (they chose a public TLD)… just baffles me honestly. New content from department still appears on their “flagship” site, but also these one offs pop up as well. They also have, and use, a url shortening service on their main domain (e.g. government.example/{taxes,vehicles,covid} redirects to the longer link on government.example) but instead some departments opt to register domains instead. At least in FB’s case those might not be for their user’s use (the obscure fb<xyz>.example domains>)? Has anyone else seen something like this in their local area?

frontalier 3y ago
it's .ch right?
Moru 3y ago
The worst part is when they buy a custom domain and then abandons it after a few years. And then someone buys the domain to host a scam instead.

vasco 3y ago

Most of these a user wouldn't ever see even as a URL temporarily in a redirect, most of these you'd only see if you're inspecting traffic. In fact you can see they purchased a bunch of typos of instagram for example, presumably to reduce user exposure to scams on similar domains.

snailmailman 3y ago

The first time I got an email from Facebook I thought it was a scam- because they don’t send their emails from Facebook.com they send them all through Facebookmail.com Their help article about this seems to imply that they also use Metamail.com now, but checking my email I am seeing only seeing emails from addresses ending with @email.meta.com

nojs 3y ago
Not sure about Meta but a lot of companies do this to preserve the domain reputation of their main domain, since sending mass or automated emails may degrade it and lead to things being marked as spam.

ororroro 3y ago

It gets worse, "youtube.com.fb.me" and similar are also in this list.

jowea 3y ago

Can someone explain why can't they just create a new subdomain for each of their stuff? Is it because it's easier to deal with the registrar and pay instead of the internal bureaucracy to assign a domain name? Is there some technical reason? I know that user-generated content may end up on separate domain for cookie reasons but is there anything else?

nonrandomstring 3y ago
I wrote about it a few days ago in response to Troy Hunt's FedEx post [0]. To answer your question, one of the reasons they don't use their own subdomains is that it's cheaper to delegate lots of support services to third party providers. Another is to avoid "polluting" their domains in the eyes of various reputation filters. [0] https://cybershow.uk/blog/posts/scamicry https://cybershow.uk/blog/posts/scamicry

geor9e 3y ago

Normal people just see facebook.com in their browser URL box and will never be dealing with the hundreds of different CDN domains it might be pulling from anyway, unless they're inspecting the HTML in dev tools.