Slashdot Mirror
ICANN Domain Expansion Could Increase Phishing
Orome1 writes "The ICANN board gave final approval to what some are calling 'the most dramatic change to the Internet in four decades,' allowing the expansion of new TLDs. Some argue this ICANN initiative could force a land grab of domains by businesses to protect their company reputation. However, they aren't the only ones who are likely to try to snag these new top level domains. There's a very legitimate concern that cybercriminals could also seek these new domains to create legitimate looking websites using well-known brand names. These can then be used for phishing attacks or delivery of Trojan malware to unsuspecting visitors."
.bank .banking .finance .lending .mortgage .ach
"It will cost $185,000 to apply, and individuals or organizations will have to show a legitimate claim to the name they are buying." I do not think that Peggy will be able to set up .discovercard :p
Seems to me that the threat of phishing can be mitigated my requiring the entity registering the domain name to show proof that the name in the *.brand is in fact a registered trademark. Of course, I could just be taking an over simplified look at the problem.
Yes, any change to how the internet works could increase phishing. But at $185,000 per application for a new TLD, as well as having each application reviewed by a human or committee, this isn't going to be like automating the registration of .com addresses so that in an afternoon, you can register every misspelling of bankofamerica. By no means do I have blind faith in them, but I feel like ICANN will be pretty sure to not allow some random dude in eastern Europe to register .bank.
Yes, yes, everything can increase the risk of cancer in lab rats, and everything increases the risk of phishing, but the barrier for entry is set relatively high here.
"Thats a mighty fine brand ya got there, company. Be a shame if someone came and - bought it as a TLD. For about 200 grand, we can help protect you."
It's gonna cost a lot of money to get a vanity top-level domain. In order to prevent domain squatting. But won't this just allow those with deep-pocketbooks to call the shots? How well did .biz do? I don't think that in my vast Internet surfing I've ever intentionally visited a .biz address.
I'm sure big businesses will snatch up their brand names out of fear and a misguided sense of getting on the bandwagon as soon as possible.
Inc. or Corps Ltd. (computer or music)
This scheme is nothing more then a cash grab. It does nothing useful for domain names. The cost of one of these is sky high ($185,000). There's no need being filled. It's just ICANN trying to get people who already have big websites to pay for another domain for the same site to keep someone else from registering it.
This stuff should not be run on a "how do we extort more money out of DNS" methadology.
-- "So they told me that using the download page to download something was not something they anticipated." - Bill Gates
Realistically, someone who gets tricked by a fraudulent "mybank.bank" [example given in TFA] is equally likely to be tricked by "mybank.us", or "mybank.com". And we already have made browsers as nearly-idiot-proof as possible so it should display a big scary warning when they try to visit that URL anyway. I don't see this as being that much of a problem.
More than 10 years ago I proposed that a TLD be officially reserved for _standard_ local private use. Basically something similar to RFC1918 but for TLDs.
I proposed it to the ICANN (emailed to icann@icann.org, Esther Dyson and Vint Cerf) and later the IETF: http://tools.ietf.org/html/draft-yeoh-tldhere-01
No luck, and I'm not rich enough to buy it (and give it to the world). Maybe Google can?
It's not the possibilities of phishing that create phishing, but the will and greed of people. Even if phishers can't use a domain name, they'll use just a IP address. And people who believe that 'mybank.ru' is really they bank will equally believe that 'xxx.xxx.xxx.xxx' is their bank.
Whoever wrote this either cannot read, or is too lazy to read. It is not going to be easy to get these TLDs. For starters, each TLD will cost $185,000. The applications will also be investigated before the TLDs will be created.
Slashdot used to be a top-notch website, but lately the editors seem to be content to post any old bullshit as a legitimate story. This story should never have been accepted for submission.
Proverbs 21:19
If ICANN allows people to obtain TLDs such as .comm, .ccom, .nett, .orrg, and so forth then we're in for a lot more scams and phishing attempts.
I wonder how well the vanity domains will work in the wild, though. They only work as well as software supports them. In theory it shouldn't be too much of a problem, but in reality I would not be surprised if a lot of software chokes on them.
.pr0n .porn .sex
How long will it take for someone to grease the right hands and get a hold of .intranet or .localhost?
This whole scenario seems to only benefit the pockets of ICANN execs. So why wouldn't they start allowing domains that could seriously break stuff if the price was right?
What was wrong with each of these superbrands being a .com?
Besides the "we already hit diminishing returns on major corporations trying to lock in all the domains they might want" problem ICANN had?
Maybe this is so companies can be their own registrar, once they have a .tld, so newflavor.coke can be held until newflavor's announcement date, without people seeing that it has been registered (or speculators buying them up before coke even decides on the newflavor's name?) - this is a marginal problem at most.
I guess having your own domain and creating subdomains as you see fit wasn't good enough for these companies. people might confuse newflavor.coke.com and (unaffiliated speculator site) newflavor.com.
I see this as one more step toward corporatizing the internet - you'll need the backing of some major company for your content to be visible.
becausr THAT will be a money maker.
From the end user perspective, this has the same net effect as opening up exactly one more top level domain: the blank TLD. It just happens to be a way more expensive TLD than any of the other ones, and has a higher chance of coercing companies into registering it. It does not add any new functionality that I can think of (NPR interviewed some asshat this morning talking about how Canon would hypothetically be able to open .canon domains and have cameras automatically upload pictures as they are taken, as if they couldn't already do that with subdomains and existing technology).
Really what aggravates me on a personal level is the support calls I am going to start getting. I work at a small ISP, and while I am largely higher tier support, I still sometimes end up being the first point of contact for customers calling in when tier 1 support gets overloaded. I just shudder at the thought of trying to explain to one of my 85 year old customers, who just finally figured out what a URL looks like that no, "msn" is actually a real address now. The normal TLDs are useful for triggering pattern recognition. In that sense this is actually making the internet harder for anybody who is not technologically savvy to learn.
Not to mention, I just can't wait to see what all of the tools on the internet that automatically convert URLs into hyperlinks do.
...OpenNIC charges $0 for TLD applications, and since it's a transparent democratic approval process, you get to actively participate in the approval process. We need to show ICANN there are alternatives to their extortion attempts.
Organized crime group forms a corperation called.... Continental Options Network.... and buys the .con TLD.
Now the price is nothing to organized crime, if the payout potential is big.
Hire some killer IT and networking black-hats. Give them $350,000US a year to live in china, south america, Russia, etc.. so they can life like rockstars and do epic coding for their data centers.
First sit low and record the number of typos for sites to .con instead of .com you can data mine where it comes from and target certian areas. set up the fake sites to load their bomb that only shows up ONCE and then innocently redirects to the real site.
and so on... heck even MITM attacks could be done.
This kind of cash is peanuts to organized crime. and if they hired good enough black hats and paid them well they could easily outwit the securoty companies long enough to make a giant pile of cash.... rinse, change up a little, repeat....
Do not look at laser with remaining good eye.
cybercriminals could also seek these new domains [...] These can then be used for phishing attacks
Terrorists could also seek these new domains These can then be used for terrorist attacks. Chinese hackers could also seek these new domains These can then be used for chinese hacking attacks. Software pirates could also seek these new domains These can then be used for software pirating attacks. Malicious attackers could also seek these new domains These can then be used for malicious attacking attacks,..
Oh, the beautiful gloss of greality!
The more power people have, the more they'll use it and sometimes they'll use it for bad things.
The more expression people have, the more they'll express and sometimes they'll say fraudulent things.
There. Can we now stop treating it as big news every damn time it happens with every damn trivial variation, have the debates one last time, and then agree that we need to kill humanity in order to save it?
As copyright owner of this comment, I authorize everyone to defeat any technological measure which limits access to it.
I propose '.hascheezburger' reserved for ICANN.
Coke and hookers.
Not if PepsiCo gets to .cola first.
Just toss an "R" into there:
citibank.corn
I have no idea how that comment is trolling. I pointed out how selling gTLDs creates a new bonanza of opportunity for spammers, and puts a little money into the pockets of the profiteering bastards who run ICANN. Did someone with a strong pro-ICANN slant (I didn't know any such people - outside of ICANN employees - existed) see the comment and moderate it down in retaliation?
It seems like crappy moderation to me. Bad moderator, bad bad bad.
Damn_registrars has no butt-hole. Damn_registrars has no use for a butt-hole.
Your google-fu is no good. When you want to search a domain for a string on google, you need "site:" to be followed immediately by that domain. You errantly inserted a space after the colon, which then caused google to do a massive or search between the strings "your-least-favorite-slashdot-name", "site:", and "trolltalk.com".
If you drop that extra space, and rerun the search, you will find that neither my slashdot name, nor that of countertrolling, occur on trolltalk.com.
But thanks for playing!
Damn_registrars has no butt-hole. Damn_registrars has no use for a butt-hole.
I earlier had an encounter with an AC troll, who would ignore reality and likely to try to respond with links to irrelevant AC posts.
Nonetheless, I showed that your google link was wrong. You can go ahead and do the right search, and you'll find I have nothing to do with tomhudson's trolltalk.com. I have nothing else to say in response.
Damn_registrars has no butt-hole. Damn_registrars has no use for a butt-hole.
On our network we have things like:
printserver
ntpserver
fontserver
authserver
intranet
mail
etc.
A very practical way of moving your laptop between home and work, and always automatically seeing all relevant printers. (just set your cups server to printserver:631)
We have always assumed that internet things end in a limited amount of TLDs. With this change that assumption goes out the window.
I'm pretty sure this will lead to an immense amount of DNS filtering at all parties who didn't already implement it.
In protest, I'm going to filter out all TLDs ICANN creates from this day forth, on all networks I control, who's with me?