Slashdot Mirror
New .secure Internet Domain On Tap
CowboyRobot writes "A new top-level domain (TLD) in the works for the Internet will bake security in from the outset: The .secure domain will require fully encrypted HTTPS sessions and a comprehensive vetting process for websites and their operators. If the new domain takes off, it could shift the way Web domains are secured. ICANN is expected to sign off on .secure, and for the new TLD to be up and running June or July 2013."
... when it's hacked.
Let's call it what it is, Anti-Social Media.
An insecure website by any name sucks just as bad...
*This Post Approved by the Council of Approving Things
crazy dynamite monkey
(too long, not typing)
Seriously. When every other TLD is two or three characters, they decide to go use a full word? Breaking conventions AND convenience! Whee!
For large sets, this will be our guide even unto death, for the LORD will work for each type of data it is applied to...
...for every link within subdomains
They can't even deal with malicious registrars, and they expect to enforce SSL on these .secure domains? Get real.
relevant captcha: kidded
Recall the ".pro" TLD? Supposed to be for "vetted professionals"? The first .pro I ever encountered turns out to be a crooked outfit. (If you must know, videolan.pro, which impersonates but does not actually have any connection to the real thing.) I have so far never encountered a dot-pro that was actually legit. A lesser used .biz of sorts, but with delusions of grandeur.
So I'll reserve judgement on this one. Not that it isn't a reasonable idea, I've been toying with the notion for a while. It's the execution that matters, and we'll just have to see how that pans out.
Then I realized it wasn't a joke.
This is so not going to end well.
something almost, but not quite, entirely unlike tubes.
Hmm, just a way for domain registrars to make more money? https:/// should be sufficient, browsers already inform you when you have a secure connection.
Again, I would rather have them introduce the .bank domain name, that can be registered only by verified banking institutions (they make it cost like $20,000 per year too, to further deter fraud). IMHO that, combined with PCI regulations enforcing the security of sites hosted on such domains, would be infinitely more useful.
Bow before me, for I am root.
When I first saw this I though, "Oh good, no more explaining to Grandma that you need to check for HTTPS://", but it is a bit to type. Why not replace "https://" with "shttp://" or "secure://"?
Isn't this exactly what Extended Verification Certificates were supposed to be for?
Why should I trust some arbitrary party to vet the security of a website by the virtue it's accessible with a particular TLD? I get that TLS shouldn't require any third parties merely to establish a secure pipe, but if you *are* looking for a third party to vet other stuff, like your bank's privacy policy and whatnot, this is exactly what PKI *does* do well, at the protocol level.
Wonder what the public key field is for?
.sec is just a fat finger slip away from .sex, which I can only assume will some day be its own TLD at the rate ICANN is handing them out. Can you imagine accidentally stumbling upon https://discreteaccountants.sex/ ?
Hold that thought. I just had an idea for a startup.
If they are going to do this, can they at least shorten it? How about ".sec"?
So, who maneuvered this one into being, so that one they and their closest friends can approve people for this TLD? Oh, and we should start teaching the uneducated public that *.secure is the only way for a site to be trustworthy, so that those key players can make even more money from certificates that cost nearly nothing to generate.
I THOUGHT THAT WAS THE POINT OF HTTPS?!
This TLD nonsense is just awful, seriously, so awful.
Some dethrone those twats already, they are useless and just destroying the DNS world.
All they want to do is rob people of even more money.
These new TLDs are just an even larger redundancy being tacked on to the internet.
It should have been protocol://ccTLD.domaintype.domain.subdomains/directories/file.ext (and domain type would have been things like museum, hotel, banking, etc)
Quick example: http://uk.search.google.images/?trillion_parameters_here (you can take your little and middle endians and spin on it!)
But they even managed to screw THAT one up! To think these supposed smart people had such insight to have come together to create this glorious network...
Now they are doing useless_protocol_consider_deprecation://subdomains.domain.domain2/directories/file.ext
TLDs don't even exist anymore, pretty much. To even think of them as TLDs is pointless.
GOD.
I'll see you all on usenet or openNIC or whatever else replaces it if (please be when) the web comes crashing down.
I mean there it is, just another plan to extort money, which then gets added to the product, which we pay for and somebody else is chipping off a little bit for themselves.
Given the rousing success of .mail, which immediately succeeded in reducing spam to a...oh...wait...
.pro, which is used exclusively by millions of professionals and...oh...umm...
.secure domain? Everyone knows they're secure.
And then there's
Alright, never mind that. Of course it will be secure, because a well-known security company is on the job and...oh...errrrmm... Verisign, Pillar of Internet Security, Hacked...
Doesn't matter. I'm certain it will work perfectly. I mean, really, what blackhat would target a
Hack one. Purpose defeated.
ICANN is a menace that needs to be put out of its misery.
-- "So they told me that using the download page to download something was not something they anticipated." - Bill Gates
Where's the accredited applicants only ".bank" gTLD to help prevent phishing of financial institutions, for instance?
Not all "banks" are financial. Who would get blood.bank or sperm.bank?
http://nigerianfortunes.za/scam.aspx?decoy=www.legitimate.secure
Not that that's a good one, but really. Anyone who understands doesn't need this, and anyone who doesn't, will be easily fooled.
Will this TLD provide a mechanism for filtering out packets with the evil bit set?
IETF
Isn't this exactly what Extended Verification Certificates were supposed to be for?
I imagine that it's a TLD for which type-in traffic is intended to go on HTTPS instead of HTTP, and for which browsers can expect DNSSEC and EV certs and fail if not present.
I want to get not.secure, so I can create the domain this.is.not.secure.
of course you can check, if an ip only runs https, when registering the domain. But you cannot check, if the ip accepts http at some point later on ... and even with regular checks, a firewall could allow http for clients and disallow it for the checker-ip.
Also implying https on = secure. then the browser display of 'valid certificate' would just be enough.
Unless it's secured from governments, agents provocateurs, corporate raiders, etc, it's not secure.
These days, it's not just random Slavs looking to jack your CC info you need to keep watch for...
An enigma, wrapped in a riddle, shrouded in bacon and cheese
...norton.secure and mcafee.secure found to be hosting ransomware and malware.
Silence is a state of mime.
and a comprehensive vetting process for websites and their operators.
What, like the one required to get a signed SSL cert? Oh wait, I mean the one to get an "Extended Validation" SSL cert.
Just because you're paranoid doesn't mean there isn't an invisible demon about to eat your face
When you use a https site you don't need the TLD to tell that it is secure: the protocol name is what's to be counted on.
The fundamental problem is that while everyone realizes that there's no such thing as perfect security in the real world, the vast majority of the nontechnical population seems to have this ridiculous assumption that there is such a thing as perfect security on the internet.
Will it just take time and generations of internet users to change that mentality? Or are we forever doomed by "computers are magic".
You know, and f*ing fix the certificate system. Make it so certificates are generated off some sort of DNS record information or something and add that info to the info registrars have. Or something. Buying certificates is almost like blackmail, and even if you do buy one it's not like your cert auth isn't vulnerable to attack or users won't just hit the "add exception" button when they get spoofed.
Oh and as was mentioned above, making a .secure domain is like putting a target on yourself. Good luck with that one.
That would imply that all certificate authorities can be trusted.
For christ sakes, we already have "premium" priced SSL certs that turn the address bar to green.
Secondly, you're suggesting that secure:// should explicitly be defined as HTTP encapsulated in SSL.
HTTP or SSL is not at all future-proof. In some alternate universe, someone could have made gopher:// encapsulated in SSL and called it secure://, but like hell that'll fly here.
Yes, I know there is already a ".coop" gTLD, but that's just for the birds.
Yeah, especially the Montana Poultry Growers Cooperative.
I don't think a new domain will prevent stupid mistakes like this: http://www.theregister.co.uk/2011/06/14/citigroup_website_hack_simple/ In short, Citibank's website was "hacked" by changing the account number in the URL. Account numbers exposed via GET requests.