5 ms·
>(This isn't a particularly idle concern. Amazingly Microsoft once got a court to let it take operational control of the domain no-ip.org — that is, to actually
by jdong 4y ago
>(This isn't a particularly idle concern. Amazingly Microsoft once got a court to let it take operational control of the domain no-ip.org — that is, to actually hijack the domain — a dynamic DNS service used by countless people — simply because one user was apparently using it for malware-related purposes.)
What a dishonest take. Microsoft didn't wasn't granted this court order because there was one bad no-ip user, Microsoft was granted the court order because there was a bad no-ip user that no-ip wouldn't take action against.
Oh, and it wasn't one bad user. It was 22000 different hostnames.
- Rygian 4y agoThat's like your landlord handing the keys to your condo to the bully upstairs because you have a cockroach problem.
- dotancohen 4y agoMore like your landlord handing the keys to your condo to the bully upstairs because somebody else on your floor has a cockroach problem.
- RobotToaster 4y agoOr to be more precise, the keys to every condo in the building.
- rosnd 4y agoIt's like a judge ordering you to hand over your keys to the person living underneath because you have a water leak you refuse to fix. Perhaps the water leak was caused by someone else, but it's still in your apartment.
- Dylan16807 4y ago1. That would still be ridiculous. 2. The water leak isn't actually in the apartment if we're keeping this accurate to domains. Maybe the only phone the plumber will listen to is in the apartment. 3. As someone else already said, the judge is handing over the keys to the entire building.
- rosnd 4y ago>1. That would still be ridiculous. How would it be ridiculous? A water leak in your flat is causing damage to the flat below yours, it's your duty to address this. If you do not address this, someone will in fact go to court and take control of your flat. This is something that happens all the time in cases where compliance with specific performance orders seems unlikely.
- hlandau 4y agoAuthor here. If the sought action of the court case, and the outcome were, "the domain were taken down" that would be one thing. Domains get suspended by court cases all the time, that's not the issue. What makes the no-ip.org case extraordinary is that Microsoft a) persuaded the court that the domain was being used for malware, and then b) persuaded the court that because of this, rather than doing something normal like compelling its operator to take down the afflicted subdomains, or failing that compelling a third party to suspend the domain, that they should be allowed to take over DNS service for the domain. Microsoft is not the law and they have no special legal status. If a domain is being used for cybercrime it's one thing, it doesn't mean any random party should get to walk into court, complain about it, and then offer to "solve" the issue by randomly appointing itself DNS provider. Microsoft essentially hijacked and MitM'd the domain via court order, again demonstrating that the registries/registrars will always be a risk here. The result I might add was a massive outage for a massive number of innocent no-ip.org users.
- huggingmouth 4y agoI think the fundamental issue here is that the court actually granted Microsoft's rediculus request. The only valid ruling here was for the court to order the suspension of the domain. Seeing that Microsoft are an unrelated third-party, what was the judge's reasoning for granting them specifically ownership of the defendant's property? Wouldn't it have made more sense to assign ownership to a government organization instead? Did Microsoft reimburse the domain owner the value of the domain or did they just steal it without payment?
- hlandau 4y agoIt all got reversed eventually after massive negative press coverage. I don't think Microsoft took "ownership" of the domain, but simply got the court to make them the nameservers, though I may be wrong. I do feel like the only way this request was granted was due to total ignorance on the part of the court of anything about how the internet works.
- rdxm 4y ago
- huggingmouth 4y agoRegardless of whether you think it's dishinest or not, his point still stands: tls mitm is not and cannot be mitigated via DNS.
- tptacek 4y agoNor with DNSSEC: the same government that gave Microsoft control over this zone has de jure control over DNSSEC key management for that zone.
- huggingmouth 4y agoI wish there was wide support for public-key-addressable servers (like tor adresses). It won't solve the issue of memorable names, but it could solve this bootstrapping problem. Perhaps le should look into encorperating tor into its domain verification process.
- hn_go_brrrrr 4y agoHow do you handle key rotation?
- Zamicol 4y agoPublish merkle roots on global ledgers like blockchains.
- withinboredom 4y agoHandshake (namebase.io) comes to mind.
- josephg 4y agoWhen you connect to the service, the client tells the server which public key (key A) its expecting the server to prove that it has ownership of. If the key A is still valid, the server can use the corresponding private key to sign a challenge. If the key has been rotated out, the server instead presents the new key, and a signature. Eg, the server responds by naming key B, and presents a certificate of key B, signed by key A (the presented key). Instead of just a single key rotation the server could present a chain of certificates from A to B to C (the key the server wants to use). And optionally, a message saying "from now on, please make further requests using key B as key A has expired".
- throwaway0x7E6 4y agoso fucking what? it's an equivalent of a corporation invading and seizing control of an entire country because some people living there are doing it harm
- rosnd 4y ago
- throwaway0x7E6 4y ago[flagged]
- Fatnino 4y agoI have a domain on no-ip.org I remember when this happened and I was trying to debug why I couldn't reach my home server.