3 ms·

The search path spoofing argument is weak. If you depend on a DNS resolver that spoofs domain searches, what guaranteed that it wouldn't simply spoof the full r

by zimbatm 14y ago

The search path spoofing argument is weak. If you depend on a DNS resolver that spoofs domain searches, what guaranteed that it wouldn't simply spoof the full resolution as well ? In practice nobody uses the dot at the end except when writing BIND files.

sp332 14y ago
The DNS resolver doesn't need to spoof anything. If you're on network example.net and there's a server on that network called "google" then typing "google" into your address bar will resolve to google.example.net in a completely legitimate way, with no DNS spoofing.
AnthonyMouse 14y ago
>If you depend on a DNS resolver that spoofs domain searches, what guaranteed that it wouldn't simply spoof the full resolution as well ? A lot of DHCP servers do DDNS. That allows you to change your computername and get your computer registered in the local DNS as whatever-you-want followed by the local domain which is usually in the search domains list. You can't get registered as "google.com" but you can get registered as "google.com.example.com" when "example.com" is in the search domain, and now you're "google.com" (but not "google.com.") to everybody on the local network.
- zimbatm 14y ago
  Yeah agreed but what's the most likely outcome. You rewriting your urls or you fixing your network / kicking the offending user ? You're not only impacting browsing experience but also all the scripts that are trying to connect to the domain like your google drive sync agent.
  - AnthonyMouse 14y ago
    >Yeah agreed but what's the most likely outcome. You rewriting your urls or you fixing your network / kicking the offending user ? Who is "you"? The person who can fix the URLs is rarely the same person who can kick the offending user off the local network. If the latter person is not doing their job (or is about to but hasn't yet), you're still better off fixing your URLs. >You're not only impacting browsing experience but also all the scripts that are trying to connect to the domain like your google drive sync agent. You don't have to break the old stuff, just start using the final dot for new stuff.

by zimbatm 14y ago

sp332 14y ago

The DNS resolver doesn't need to spoof anything. If you're on network example.net and there's a server on that network called "google" then typing "google" into your address bar will resolve to google.example.net in a completely legitimate way, with no DNS spoofing.

AnthonyMouse 14y ago

>If you depend on a DNS resolver that spoofs domain searches, what guaranteed that it wouldn't simply spoof the full resolution as well ? A lot of DHCP servers do DDNS. That allows you to change your computername and get your computer registered in the local DNS as whatever-you-want followed by the local domain which is usually in the search domains list. You can't get registered as "google.com" but you can get registered as "google.com.example.com" when "example.com" is in the search domain, and now you're "google.com" (but not "google.com.") to everybody on the local network.

zimbatm 14y ago
Yeah agreed but what's the most likely outcome. You rewriting your urls or you fixing your network / kicking the offending user ? You're not only impacting browsing experience but also all the scripts that are trying to connect to the domain like your google drive sync agent.
- AnthonyMouse 14y ago
  >Yeah agreed but what's the most likely outcome. You rewriting your urls or you fixing your network / kicking the offending user ? Who is "you"? The person who can fix the URLs is rarely the same person who can kick the offending user off the local network. If the latter person is not doing their job (or is about to but hasn't yet), you're still better off fixing your URLs. >You're not only impacting browsing experience but also all the scripts that are trying to connect to the domain like your google drive sync agent. You don't have to break the old stuff, just start using the final dot for new stuff.