Re: Non-English Domain Names Likely Delayed

[Iljitsch van Beijnum]

On 19-jul-2005, at 1:43, Crist Clark wrote:

> > If you make a bunch of assumptions
[...]

> Plus, you have to trust DNS, which means you have to trust:
>   1) the root
>   2) the gTLD
>   3) the authorative servers for the domain
> And for 99% of the users out there,
>   4) the caching servers for their ISP/employer/other access
>     provider
Actually, you don't. If the DNS provides false information, the  
public key crypto will catch this. Sure, you won't be able to  
communicate, but you can't be fished that way.

> > you can be sure that when it says https:// www.blah.com/ in your  
> > browser, you're actually communicating with the  entity holding  
> > the name www.blah.com in a secure way. So when  something
> > that looks exactly like www.blah.com is in fact different  from  
> > www.blah.com, that's a pretty big deal because it breaks the   
> > whole system.
> Assuming the system works. SSL doesn't really work now since
> so many users reflexively click through warnings about bad
> certificates.
There is no cure for stupidity... And I'm not even sure it's really  
stupidity: in their own twisted way, these users behave rationally  
because the energy to stay safe isn't worth keeping away the bad  
consequences to them. This of course changes when their online  
banking account is raided.

> And while we're at it, does any of this fix whether any of
> the following,
>     www.blah-inc.com
>     www.blah.net
>     www.blah.biz
> Might trick a user into thinking he's connected to the same
> entity that owns www.blah.com?
I don't see why this would need to be "fixed". We're not talking  
about 5 year olds, people need to be able to cross the road without  
someone holding their hand.

> > So how would fixing this make things worse?
> Wrong question. How will fixing this one problem make things any
> better?
Simple: the system then performs as designed again. All the other  
problems are more or less under the user's control.

> If almost none of the phishing emails I get now bother
> to play these kinds of games today, how much does this really help?
And burglars also manage to get inside your house even though you  
lock the door. So better not lock the door then?

> Yeah, if it's easy, go ahead, but as the mere existence of this
> thread seems to indicate this is not an easy problem. I worry that
> like many of the other spam-related problems while we have a lot of
> very smart people like yourself thinking hard about how to prevent
> abuse, we may just be rearranging the deck chairs on the Titanic.
That is such crap, and it's exactly this attitude that makes it  
possible for spam to persist. When confronted by an apparently  
intractable problem, in very many cases it helps to solve the parts  
that can be solved and then have another look at the remaining  
problem. More often than not it doesn't look as intractable any more.

> > should we be doing instead?
> Many things, perhaps the two most important "we" can do:
>   1) Pounding it into the users that you don't ever trust what it
>     says in the navigation bar unless you typed it there yourself.
>     Corrorlaries: (a) When following links on webpages, your level
>     of trust should only be that of the least trusted page in the
>     chain of links.
If this is true, it means a failure on the part of the browser. I  
don't think we should live with that but get ourself better browsers.

> (b) NEVER EVER, EVER, EVER trust a link in an
>     unsigned email.
Haha. I talked to a CERT guy a while ago. They had a service where  
they send out dumbed down warnings to regular users (not sysadmins or  
whatever). I asked him why they didn't use S/MIME to sign their mail.  
"That confuses people." Ok then. If people in the security business  
(how I hate the fact that it's a business these days!) don't even  
want to use the tools that are available, rational thought breaks  
down. (Although I have to admit that it DOES look confusing in  
popular Windows email clients.)

>   2) Pounding it into merchants, banks, etc., to make sure they never
>     ask their customers to violate (1).
Expansion of 1: don't trust any unsollicited communication. This  
includes all incoming email (unless it's signed but it never is) and  
phone calls. (Law enforcement at your door? How do I know those  
badges are real?) Never give out your password to ANYONE, EVER.

> But sorry, I do not have all of the answers either.
(-:

> [0] Perhaps a better analogy is that by "cleaning up" DNS, we are
> trying to prevent the iceburgs. We should be letting the indvidual
> merchants, banks, and other secure sites, the ships, make their
> own schemes for avoiding them. We could be helping them build stronger
> ships, something better than today's SSL, and mapping out where the
> iceburgs are, figuring out where they need to balance convenience
> versus security, than trying to clear the seas of all possible  
> hazards.
No, what's needed is that systems don't have glaring holes. Email is  
a joke, anyone can send messages with any "From" line that they want.  
Credit cards are a joke, anyone who works in a store can copy numbers  
and then use those online. The trouble with these two is that people  
have been using them as-is for so long that they don't want to give  
up the convenience of the insecurity. So at some level this is  
working for people, or they wouldn't be using it.