3 ms·

Microsoft is really bad with this. Login might be live.com or microsoftonline.com or maybe onmicrosoft.com. I went to report a vulnerability to their security p

Microsoft is really bad with this. Login might be live.com or microsoftonline.com or maybe onmicrosoft.com. I went to report a vulnerability to their security portal this week and it redirected me to b2clogin.com. OneDrive email attachments link to, I kid you not, 1drv.ms, or maybe it was 1drv.com… Not to mention, they use .ms as if it’s their personal TLD, but obviously anyone can register a .ms domain. It’s like they want people to get phished.

Retr0id 6mo ago
Until this moment I assumed .ms was a Microsoft TLD, but indeed it is not https://en.wikipedia.org/wiki/.ms https://en.wikipedia.org/wiki/.ms
- amiga386 6mo ago
  Handy tip: all two-letter TLDs are country code TLDs. Doesn't matter if they're trendy in website names (.nu, .cc, .io, .co, .it, .at, .cx, youtu.be and so on) In fact, here we have the ma.tt website, where the ".tt" is Trinidad and Tobago. Is Matt Mullenweg from Trinidad? No!
  - the_mitsuhiko 6mo ago
    Though not all country codes point to a country. See .eu, .ac .su as different examples of stuff that breaks the rules.
    - mghackerlady 6mo ago
      the .su domain was made when the soviet union was still around, so that doesn't really break the rules. I would prefer for top level domains to be eternal for a great multitude of reasons
      - SAI_Peregrinus 6mo ago
        The possible annoyance with eternal country-code TLDs would be the dissolution of one country, and the creation (or renaming) of another country resulting in an eventual exhaustion of two-letter country codes. Eternity is a rather long duration.
        toast0 6mo ago
        Before exhaustion, you're likely to have new countries where they have to have suboptimal two letter codes, because a dissolved country is squating on it.
        razakel 6mo ago
        An interesting one is .uk, because the UK's country code is actually GB (the ccTLD is delegated, but unused). And that's before we get into the really weird not-a-proper-country ones like .im or .pn.
        mghackerlady 6mo ago
        if we run out of 2 letter TLDs, move to 3 letter ones. it really wouldn't be that hard. Also, that's assuming our current system stays in place
        SAI_Peregrinus 6mo ago
        The country code TLDs are ISO country codes. Nothing technically requires that to continue, but if ISO re-uses a country code & ICANN doesn't, it'll get somewhat confusing.
        mghackerlady 6mo ago
        If anyone would avoid reusing codes, it's the ISO. They love legacy compliance and compatibility (which is why I have tremendous respect for them when I'm designing software since they've certainly thought about something more than I have)
  - mayoff 6mo ago
    It's kind of crazy that the IRS (among other United States government agencies) uses ID.me for account management. The .me domain belongs to Montenegro.
    - anon7000 6mo ago
      I think ID.me is a private company. So yeah, it’s especially fucking stupid that they use that in the first place. Any gov login should be required to go through a .gov tld. At least reverse proxy it or something!
- RGamma 6mo ago
  They also use .microsoft now (e.g. for the M365 admin portal).
deleted 6mo ago
[deleted]
anon7000 6mo ago
We’re talking about the company who owns npm, one of the most hacked package registries in recent history. Can’t say I’m shocked, but this is so bad

Retr0id 6mo ago

Until this moment I assumed .ms was a Microsoft TLD, but indeed it is not https://en.wikipedia.org/wiki/.ms https://en.wikipedia.org/wiki/.ms

amiga386 6mo ago
Handy tip: all two-letter TLDs are country code TLDs. Doesn't matter if they're trendy in website names (.nu, .cc, .io, .co, .it, .at, .cx, youtu.be and so on) In fact, here we have the ma.tt website, where the ".tt" is Trinidad and Tobago. Is Matt Mullenweg from Trinidad? No!
- the_mitsuhiko 6mo ago
  Though not all country codes point to a country. See .eu, .ac .su as different examples of stuff that breaks the rules.
  - mghackerlady 6mo ago
    the .su domain was made when the soviet union was still around, so that doesn't really break the rules. I would prefer for top level domains to be eternal for a great multitude of reasons
    - SAI_Peregrinus 6mo ago
      The possible annoyance with eternal country-code TLDs would be the dissolution of one country, and the creation (or renaming) of another country resulting in an eventual exhaustion of two-letter country codes. Eternity is a rather long duration.
      - toast0 6mo ago
        Before exhaustion, you're likely to have new countries where they have to have suboptimal two letter codes, because a dissolved country is squating on it.
        razakel 6mo ago
        An interesting one is .uk, because the UK's country code is actually GB (the ccTLD is delegated, but unused). And that's before we get into the really weird not-a-proper-country ones like .im or .pn.
      - mghackerlady 6mo ago
        if we run out of 2 letter TLDs, move to 3 letter ones. it really wouldn't be that hard. Also, that's assuming our current system stays in place
        SAI_Peregrinus 6mo ago
        The country code TLDs are ISO country codes. Nothing technically requires that to continue, but if ISO re-uses a country code & ICANN doesn't, it'll get somewhat confusing.
        mghackerlady 6mo ago
        If anyone would avoid reusing codes, it's the ISO. They love legacy compliance and compatibility (which is why I have tremendous respect for them when I'm designing software since they've certainly thought about something more than I have)
- mayoff 6mo ago
  It's kind of crazy that the IRS (among other United States government agencies) uses ID.me for account management. The .me domain belongs to Montenegro.
  - anon7000 6mo ago
    I think ID.me is a private company. So yeah, it’s especially fucking stupid that they use that in the first place. Any gov login should be required to go through a .gov tld. At least reverse proxy it or something!
RGamma 6mo ago
They also use .microsoft now (e.g. for the M365 admin portal).

deleted 6mo ago

[deleted]

anon7000 6mo ago

We’re talking about the company who owns npm, one of the most hacked package registries in recent history. Can’t say I’m shocked, but this is so bad