Email or username:

Password:

Forgot your password?
Fediverse's posts Post Back to profile
Top-level
Inventor

@fediversereport Anyone can create "social." subdomains.
It does not make it "clear that it's an official government account".

13 Sep 2023 at 2:28 | Wall-to-wall | Open on linuxrocks.online
21 comments
Myrion

@inventor how so? In the Swiss example, the govt controls admin.ch, and no-one else can create those subdomains. Sure, it could be a rogue sysadmin, but that would get discovered and shut down quickly.

Anything from *.admin.ch has official character.

13 Sep 2023 at 18:14 | Open on infosec.exchange
Inventor

@myrion
Are you saying that someone in the government can create a rogue "mastodon.admin.ch"?
What you're saying doesn't make sense. Subdomains are irrelevant. Telling people otherwise will only cause more phishing attacks.
Example: social.govern.ment.eu
People fall for stuff like that. "social." is irrelevant.

13 Sep 2023 at 18:26 | Open on linuxrocks.online
Myrion

@inventor I'm saying that's the only way I can see someone getting a *.admin.ch subdomain without it being official, yes.

I don't think it's likely to happen.

And no, I'm not worried about someone creating social.ad.min.ch (if I'm understanding your examples correctly) to confuse people. It would have happened long ago already, since the Swiss government has been using admin.ch for years now for official communications.

13 Sep 2023 at 19:02 | Open on infosec.exchange
Inventor
Myrion

@inventor I understand the concept of phishing attacks. I understand that they can even be performed against government workers.

This doesn't change the simple fact that admin.ch has been the official domain of the Swiss government for years and that social.admin.ch clearly is from the Swiss government, and that other governments following the same structure of social.well-known.domain is perfectly sensible.

At this point, I'm very confused about what you're even trying to argue, as the article doesn't have a single example mentioning subdomains (frankly, no details at all).

Phishing exists, therefore governments shouldn't be on the fediverse?
Phishing exists, therefore government accounts must be... what? Only from the main domain, because that's somehow safer?

@inventor I understand the concept of phishing attacks. I understand that they can even be performed against government workers.

This doesn't change the simple fact that admin.ch has been the official domain of the Swiss government for years and that social.admin.ch clearly is from the Swiss government, and that other governments following the same structure of social.well-known.domain is perfectly sensible.

13 Sep 2023 at 19:22 | Open on infosec.exchange
Myrion

@inventor to rephrase my argument most clearly:

The Swiss government has been using *.admin.ch for official communication for years.

Phishing attacks pretending to be the Swiss government have happened.

This doesn't make communication from *.admin.ch any less clearly official.

This holds true even when *==social.

13 Sep 2023 at 19:25 | Open on infosec.exchange
Inventor

@myrion
"government accounts must be only from the main domain, because that's somehow safer?"

It can be from any subdomain under a valid root domain. Examples: "социальные.", "с.", "со.", "sociaux.", "sosyal.", "mastodon."... literally anything. Doesn't matter at all.

Only the root domain and certificate matter.

13 Sep 2023 at 19:29 | Open on linuxrocks.online
Myrion

@inventor aha! Then I misunderstood your objection.

I will say that while it's true, I think it's a bit pedantic. The OP wasn't suggesting, afaict, that "social.any.domain" clearly would be official, but that "social.known.domain" would be clearly official, and sensible - in that it's like the ".well-known" directory on a webserver.

Use the known domain, look for the social subdomain and voilà, there's the official social media accounts seems like a useful approach to me.

13 Sep 2023 at 19:34 | Open on infosec.exchange
Siegi 🇺🇦 🇬🇪 💜 🇨🇭

@inventor 1. The government create the instance on his own subdomain of admin.ch which is the federal domain and well known
2. They announce it and say which department want start to have an account (DFAE, DEFR)
3. They own and manage admin.ch, i think that persons managing DNS of admin.ch don't let everyone create what subdomain they want.

Maybe you mean the .social top level domain where everyone can create domain ?
@fediversereport

@inventor 1. The government create the instance on his own subdomain of admin.ch which is the federal domain and well known
2. They announce it and say which department want start to have an account (DFAE, DEFR)
3. They own and manage admin.ch, i think that persons managing DNS of admin.ch don't let everyone create what subdomain they want.

13 Sep 2023 at 18:15 | Open on tooting.ch
Inventor

@siegi @fediversereport

Are you saying that someone in the government can create a rogue "mastodon.admin.ch"?
What you're saying doesn't make sense. Subdomains are irrelevant. Telling people otherwise will only cause more phishing attacks.
Example: social.govern.ment.eu
People fall for stuff like that. "social." is irrelevant.

13 Sep 2023 at 18:31 | Open on linuxrocks.online
Gregory Trolliet

@inventor @siegi @fediversereport I don't understant. As owner of trolliet.info, you mean that anybody can create social.trolliet.info without my conscent and/or knowing?

13 Sep 2023 at 18:34 | Open on mastodon.zaclys.com
Inventor

@Faket @siegi @fediversereport
What I am saying is that you or anyone who is not the government could register any domain similar to a domain that a legit governmental organization uses, i.e. mimic it, and then create a "social." subdomain to lure fools.
Example: social.govern.ment.eu being created by the owner of ment.eu is totally plausible.
It will happen if this idea that "subdomains mean something" takes roots.

13 Sep 2023 at 18:41 | Open on linuxrocks.online
Gregory Trolliet

@inventor @siegi @fediversereport But since the owner/administrator of admin.ch is the government, what better way to certify a new service than to make it a service.admin.ch?

13 Sep 2023 at 18:46 | Open on mastodon.zaclys.com
Inventor

@Faket @siegi @fediversereport
It is already certified by the domain. The subdomain is arbitrary and serves no purpose other than being a name for a service/server/something. The end user must only pay attention to the domain and TLS certificate for the purpose of validation of legitimacy.

13 Sep 2023 at 18:50 | Open on linuxrocks.online
Gregory Trolliet

@inventor @siegi @fediversereport So? Are you saying that doing a social.admin.ch subdomain is a good thing? I don't understand your point TBH.

13 Sep 2023 at 18:51 | Open on mastodon.zaclys.com
Inventor

@Faket @siegi @fediversereport
My point makes reference to this quote from the second post on this thread:
"Following this pattern (social. subdomains) makes it immediately clear to people they are communicating with an official government account."

This is false. Establishing a convention may be a cool idea, but it adds nothing to security or "making anything clear". Subdomains mean nothing in terms of validation of legitimacy.
Root domains and certificates, on the other hand, mean everything.

13 Sep 2023 at 18:57 | Open on linuxrocks.online
Gregory Trolliet replied to Inventor

@inventor @siegi @fediversereport Are you suggesting that it's not better to have a [social|mastodon|toot|whatever].admin.ch than any other random root domain?

13 Sep 2023 at 19:01 | Open on mastodon.zaclys.com
Inventor replied to Gregory

@Faket @siegi @fediversereport It makes no difference.
In fact, now that I think of it, a simple convention about subdomains doesn't make sense either, since many countries speak different languages.

13 Sep 2023 at 19:11 | Open on linuxrocks.online
Jezza™@threads.com (Official)

@inventor @fediversereport why not? Any random asshole is going to do just as good a job at sucking at running a government's social as the people who do it presently for profit.

BTW, I'm the official social account of the government of Abkhazia.

13 Sep 2023 at 18:20 | Open on noagendasocial.com
Luna :verified_trans: :cat_is_blob_and_lesbian:

@inventor@linuxrocks.online @fediversereport@mastodon.social but you usually recognize the main domain if you live in the country

14 Sep 2023 at 6:36 | Open on mk.absturztau.be
Go Up