Slashdot Mirror
F-Secure Calls for '.safe' TLD
Rajesh writes "According to F-Secure, ICANN (Internet Corporation for Assigned Names and Numbers), the organization responsible for the global coordination of the Internet's system of unique identifiers, should introduce a .safe domain name to be used by registered banks and other financial organizations."
But wouldn't something a little more, well, financially sound be better. .safe just makes me think of child protection sites, law enforcement security boards and such.
I know .fin is taken, but how about someone put a little more thought into this one. I agree we possibly COULD use a .safe, but for other purposes.
Brought to you by King Canute. Make things happen by simply commanding them to be so!
(yes, I'm well aware that interpretation of the story is incorrect).
I just don't trust anything that comes out and says "trust me, I'm safe." This isn't a good idea, it teaches people to let their guard down as opposed to being aware of the risks of blanketly trusting a website. What if someone gets some exploit code on one of these sites? I think it'll just take a few notable hacked up website before the whole trust of .safe is lost.
As long as people continue to click on links they get in emails, a not verify that they are actually at their bank's website, then there's going to be problems with phishing. It doesn't matter if the url ends in .com, or .ca, or .safe, or .xxx. If you're clicking on links in emails and getting scammed, then changing the domain name won't help anything. I'm surprised there's not more worms out there that change your hosts file, to show you a phishing site when you type in the actual url of your bank. I guess it really is that easy to get somebody to click on a link in an email, because they haven't resorted to more complicated methods.
Anthropic principle: We see the universe the way it is because if it were different we would not be here to see it.
People are infallible and immune from social engineering attacks and there is no way a shady organization would ever get a .safe domain.
My twitter
Count down to the first case where a .safe domain is corrupted because of nepotism, fraud, forgery, what-have-you.
.safe TLD mean, in that case?
A TLD does not solve this problem. An alert user does, aided by tools like regular check-ups, challenge-response systems or cryptography.
We've all heard how some corporations lose several thousands of records of personal data. What does that
People are still pretty dumb and easily tricked, the kind of people that get duped into putting their info in a phishing site are the same people that could be tricked by a fake URL...i.e. safe.financialsite.com or yourbank.com/safe or any other obvious ways to add safe into a URL.
In a world of acronyms, the words are the real victims.
sed -e 's/Chuck Norris/Rajnikant/g' joke > fact
I don't think so...
There will always be idiots, who will fill in their credit card information at visa.safe.ru!
09 f9 11 02 9d 74 e3 5b d8 41 56 c5 63
There is a much greater need to tell when a site is NOT safe. There is a reason that URLs with IP addresses and domain names such as "www.paypal.secure.dodgydomain.info/..." are still effective. Introduction of a new TLD is not a replacement for user education.
If a .safe TLD was introduced then too many people would automatically have the assumption that their PC would never be infected from visiting a .safe site nor would it's details on them ever be compromised. I don't believe anyone can say with 100% certainty that all .safe domains would be hacker proof, in fact I think hackers would be much more attracted to trying to break into .safe sites in the knowledge that people wouldn't automatically be vigilant when visiting those sites.
To do something right, you often have to roll up your sleeves and get busy.
Let us create a separate domain for phish hosts! All phishing sites must clearly identify them as phishing sites to get a chance to be listed in that domain. Of course, compliance is voluntary. It makes as much sense as the safe domain for the banks.
sed -e 's/Chuck Norris/Rajnikant/g' joke > fact
This sounds a whole lot like RFC #3514 to me, except on a higher level, which makes the idea at least four years old.
Even as you read this, your pants are strangling your loins! Aaa!
... I don't think it will work, at least not how they think.
Many worms change your HOSTS file and there's also the good ol' DNS poisoning, so this ".safe" thing can't be 100% trusted. And if it can't be 100% trusted, we might as well stick to what we (don't) have.
It is not the same thing. This proposal calls for whitelisting. In contrast the joke required that bad people blacklist themselves.
d itorials/dumb/
.endworldhunger
Enumerating badness is a bad idea from a security point of view:
http://www.ranum.com/security/computer_security/e
Enumerating goodness might work, but raises many issues. Who does it, based on what criteria and how are the criteria enforced?
Why do people keep demanding the DNS to solve all the problems in the world? It's just an address book, not the solution to world hunger. Oh, maybe that is the next TLD proposal:
Are we really going to have to go through every argument why .xxx was a bad idea, replacing "porn" with "safe" and "perverts" with "hackers"
quick, someone who knows regex copy the most highly modded comments from here, here, here, here and here, and save us!
click to login to http://mybank.safe/ </a>
The usual phishing tricks will work, and they'll work even better. Phisher creates a link to a phishing site, and the text of the link will point to a ".safe" domain. Naive user is as naive as ever, and thinks "Well, I know that '.safe' means that it's a genuine site, so it's safe to click on it" and cheerfully submits his/her private identity to the phishers.
Dumb idea, game over. Next...
Tired of FB/Google censorship? Visit UNCENSORED!
On the face of it, the idea is not completely awful. As usage of the internet grows, the organization of the domain names will grow in complexity and scope.
.gov for the US government sites. This makes sense. All government-owned web sites are then managed in one place. We have .edu for education institutions.
.shop for on-line shops that actually sell through their web site. eg. Amazon, TigerDirect
We have
Financial institutions are a major power in our society, like government, so maybe they should have a specific domain. This would make looking for a financial place predictable. "I need to find my bank's web site. Ah, I will try bankname.bank" knowing that you will at least get a real bank, and not a phishing scam built on a typo in a name.
There are other major market segments which could justify a TLD like libraries (.lib?) and medical (.med?).
We should not let a fear of abusers stop us from trying to organize things in a predictably way. With more TLD options, we could possibly avoid domain names having to be ever longer because their name was already taken.
Bearded Dragon
But it also sounds like an inviting and tempting invitation for hackers to prove that nothing is ".safe"
What next? Will someone build a ship and claim it's unsinkable? Oh wait...
A: Create a new TLD!
Q: (what was the question again?)
An awkward bit of history, back from when you had to follow the rules when registering domains and the US didn't have their own TLD, so they used .gov, .com, .org, .edu etc as their own and asked everybody else to use their own national TLDs.
.to domains? fly.to, go.to etc, none of which came from Tonga.
Part of me misses the enforced rules bit, as now you can't tell where a website actually originates for. Anybody remember all the
How many people can read hex if only you and dead people can read hex?
I see by the article that several chinese ISP's were asked to take down phishing sites, but refused.
...
To me that's the time to apply the internt death penalty, where the root dns servers refuse to give out the addresses of the offending domains.
We did it to korea a couple of times, with temporarily mixed results, but IMO the takedown (I think it was only 3 days) wasn't of sufficient duration to really get their attention.
--
Cheers, Gene
"There are four boxes to be used in defense of liberty:
soap, ballot, jury, and ammo. Please use in that order."
-Ed Howdershelt (Author)
Message from Our Sponsor on ttyTV at 13:58