Slashdot Mirror
New .secure Internet Domain On Tap
CowboyRobot writes "A new top-level domain (TLD) in the works for the Internet will bake security in from the outset: The .secure domain will require fully encrypted HTTPS sessions and a comprehensive vetting process for websites and their operators. If the new domain takes off, it could shift the way Web domains are secured. ICANN is expected to sign off on .secure, and for the new TLD to be up and running June or July 2013."
... when it's hacked.
Let's call it what it is, Anti-Social Media.
An insecure website by any name sucks just as bad...
*This Post Approved by the Council of Approving Things
crazy dynamite monkey
(too long, not typing)
Seriously. When every other TLD is two or three characters, they decide to go use a full word? Breaking conventions AND convenience! Whee!
For large sets, this will be our guide even unto death, for the LORD will work for each type of data it is applied to...
...for every link within subdomains
Recall the ".pro" TLD? Supposed to be for "vetted professionals"? The first .pro I ever encountered turns out to be a crooked outfit. (If you must know, videolan.pro, which impersonates but does not actually have any connection to the real thing.) I have so far never encountered a dot-pro that was actually legit. A lesser used .biz of sorts, but with delusions of grandeur.
So I'll reserve judgement on this one. Not that it isn't a reasonable idea, I've been toying with the notion for a while. It's the execution that matters, and we'll just have to see how that pans out.
Then I realized it wasn't a joke.
This is so not going to end well.
something almost, but not quite, entirely unlike tubes.
Hmm, just a way for domain registrars to make more money? https:/// should be sufficient, browsers already inform you when you have a secure connection.
Again, I would rather have them introduce the .bank domain name, that can be registered only by verified banking institutions (they make it cost like $20,000 per year too, to further deter fraud). IMHO that, combined with PCI regulations enforcing the security of sites hosted on such domains, would be infinitely more useful.
Bow before me, for I am root.
When I first saw this I though, "Oh good, no more explaining to Grandma that you need to check for HTTPS://", but it is a bit to type. Why not replace "https://" with "shttp://" or "secure://"?
Isn't this exactly what Extended Verification Certificates were supposed to be for?
Why should I trust some arbitrary party to vet the security of a website by the virtue it's accessible with a particular TLD? I get that TLS shouldn't require any third parties merely to establish a secure pipe, but if you *are* looking for a third party to vet other stuff, like your bank's privacy policy and whatnot, this is exactly what PKI *does* do well, at the protocol level.
Wonder what the public key field is for?
.sec is just a fat finger slip away from .sex, which I can only assume will some day be its own TLD at the rate ICANN is handing them out. Can you imagine accidentally stumbling upon https://discreteaccountants.sex/ ?
Hold that thought. I just had an idea for a startup.
If they are going to do this, can they at least shorten it? How about ".sec"?
So, who maneuvered this one into being, so that one they and their closest friends can approve people for this TLD? Oh, and we should start teaching the uneducated public that *.secure is the only way for a site to be trustworthy, so that those key players can make even more money from certificates that cost nearly nothing to generate.
I mean there it is, just another plan to extort money, which then gets added to the product, which we pay for and somebody else is chipping off a little bit for themselves.
Given the rousing success of .mail, which immediately succeeded in reducing spam to a...oh...wait...
.pro, which is used exclusively by millions of professionals and...oh...umm...
.secure domain? Everyone knows they're secure.
And then there's
Alright, never mind that. Of course it will be secure, because a well-known security company is on the job and...oh...errrrmm... Verisign, Pillar of Internet Security, Hacked...
Doesn't matter. I'm certain it will work perfectly. I mean, really, what blackhat would target a
Hack one. Purpose defeated.
ICANN is a menace that needs to be put out of its misery.
-- "So they told me that using the download page to download something was not something they anticipated." - Bill Gates
Where's the accredited applicants only ".bank" gTLD to help prevent phishing of financial institutions, for instance?
Not all "banks" are financial. Who would get blood.bank or sperm.bank?
Isn't this exactly what Extended Verification Certificates were supposed to be for?
I imagine that it's a TLD for which type-in traffic is intended to go on HTTPS instead of HTTP, and for which browsers can expect DNSSEC and EV certs and fail if not present.
Ironically, your proposal is actually horribly similar to this pointless-loads-of-arbitrary-TLDs nonsense, just in reverse order and with questionably useful ccTLDs prepended.
.mil) URLs are either going to be largely meaningless or an unbelievably ungainly apparatus will have to be deployed to hammer out the possible categories of the internet and then force all the TLDs and subdomains into submission.
The 'domaintype' notion is the kicker. It isn't quite as broad as an arbitrary string; but it is very broad indeed, and would be the stuff of endless wrangling(and, since many sites do multiple things, would suffer from similar must-protect-trademark-on-all-possible-domains shenanigans). At some point, you have to give up and accept that(outside of a few, largely sterile, walled gardens that maintain order mostly by virtue of being a direct projection of a real-world organization, like
I want to get not.secure, so I can create the domain this.is.not.secure.
of course you can check, if an ip only runs https, when registering the domain. But you cannot check, if the ip accepts http at some point later on ... and even with regular checks, a firewall could allow http for clients and disallow it for the checker-ip.
Also implying https on = secure. then the browser display of 'valid certificate' would just be enough.
Unless it's secured from governments, agents provocateurs, corporate raiders, etc, it's not secure.
These days, it's not just random Slavs looking to jack your CC info you need to keep watch for...
An enigma, wrapped in a riddle, shrouded in bacon and cheese
...norton.secure and mcafee.secure found to be hosting ransomware and malware.
Silence is a state of mime.
and a comprehensive vetting process for websites and their operators.
What, like the one required to get a signed SSL cert? Oh wait, I mean the one to get an "Extended Validation" SSL cert.
Just because you're paranoid doesn't mean there isn't an invisible demon about to eat your face
When you use a https site you don't need the TLD to tell that it is secure: the protocol name is what's to be counted on.
The fundamental problem is that while everyone realizes that there's no such thing as perfect security in the real world, the vast majority of the nontechnical population seems to have this ridiculous assumption that there is such a thing as perfect security on the internet.
Will it just take time and generations of internet users to change that mentality? Or are we forever doomed by "computers are magic".
You know, and f*ing fix the certificate system. Make it so certificates are generated off some sort of DNS record information or something and add that info to the info registrars have. Or something. Buying certificates is almost like blackmail, and even if you do buy one it's not like your cert auth isn't vulnerable to attack or users won't just hit the "add exception" button when they get spoofed.
Oh and as was mentioned above, making a .secure domain is like putting a target on yourself. Good luck with that one.
Yes, I know there is already a ".coop" gTLD, but that's just for the birds.
Yeah, especially the Montana Poultry Growers Cooperative.
I don't think a new domain will prevent stupid mistakes like this: http://www.theregister.co.uk/2011/06/14/citigroup_website_hack_simple/ In short, Citibank's website was "hacked" by changing the account number in the URL. Account numbers exposed via GET requests.