TE
TechEcho
Home24h TopNewestBestAskShowJobs
GitHubTwitter
Home

TechEcho

A tech news platform built with Next.js, providing global tech news and discussions.

GitHubTwitter

Home

HomeNewestBestAskShowJobs

Resources

HackerNews APIOriginal HackerNewsNext.js

© 2025 TechEcho. All rights reserved.

HSTS Preload lists cause Chromium to think http://google/ is a valid domain

69 pointsby coderobeabout 8 years ago

9 comments

Animatsabout 8 years ago
I warned about this back when all those new TLDs were being considered. Single-word TLDs are not properly supported in browsers, in DNS, or even at the glibc level.<p>At the browser level, is it a keyword or a domain? Try &quot;ai&quot;. &quot;ai&quot; is a real domain, and there&#x27;s a web site at &quot;<a href="http:&#x2F;&#x2F;ai&quot;" rel="nofollow">http:&#x2F;&#x2F;ai&quot;</a>, touting the advantages of starting an offshore company in Anguilla. Most browsers interpret &quot;ai&quot; as a search term by default. If you enter &quot;ai.&quot;, though, you&#x27;ve specified a rooted domain name (a feature few people know about) and should get the &quot;ai&quot; web site. Firefox understands this, but Android doesn&#x27;t. Try various browsers.<p>At the glibc level, there&#x27;s an exploitable bug, which I reported in 2012.[1] It&#x27;s still open. The bug was first seen in 2011 and reported on serverfault.[2] The problem is that glibc DNS lookup has a feature which is supposed to allow abbreviating domain names. The idea was that if you&#x27;re on &quot;something.harvard.edu&quot; and you look up &quot;law&quot;, it tries &quot;law.harvard.edu&quot;. The exploit is that if you&#x27;re on &quot;foo.com&quot;, and you look up &quot;baz.com, glibc tries &quot;baz.com.com&quot;. There&#x27;s a domain &quot;com.com&quot;, and it has a wildcard DNS server, so it will resolve &quot;baz.com.com&quot;. What&#x27;s there? A scam. &quot;You are selected by G00GLE to be among the first few persons to win an iPhone 7...&quot;.<p>This behavior is a problem for all single word domains. Whether it is active depends on the hostname of your local host. It&#x27;s mostly a server problem, but some ISPs issue clients hostnames such as &quot;12345678.comcast.net&quot;, which means that &quot;google&quot; gets tried as &quot;google.comcast.net&quot;. Fortunately, &quot;google.comcast.net&quot; doesn&#x27;t resolve in DNS. Neither does &quot;com.comcast.net&quot; ISPs need to be careful about this.<p>(It&#x27;s a big problem if you&#x27;re writing a web crawler, which is why I know about it.)<p>[1] <a href="https:&#x2F;&#x2F;sourceware.org&#x2F;bugzilla&#x2F;show_bug.cgi?id=13935" rel="nofollow">https:&#x2F;&#x2F;sourceware.org&#x2F;bugzilla&#x2F;show_bug.cgi?id=13935</a> [2] <a href="http:&#x2F;&#x2F;serverfault.com&#x2F;questions&#x2F;341383&#x2F;possible-nxdomain-hijacking" rel="nofollow">http:&#x2F;&#x2F;serverfault.com&#x2F;questions&#x2F;341383&#x2F;possible-nxdomain-hi...</a>
评论 #13805408 未加载
评论 #13805301 未加载
mholtabout 8 years ago
A great case study in &quot;The Web is hard.&quot;<p>I stumbled on this earlier this week: <a href="https:&#x2F;&#x2F;twitter.com&#x2F;mholt6&#x2F;status&#x2F;838504217731948544" rel="nofollow">https:&#x2F;&#x2F;twitter.com&#x2F;mholt6&#x2F;status&#x2F;838504217731948544</a> and found it amusing but confusing in two ways:<p>1) The prompt is pointing to the &quot;Secure&quot; icon; I thought it was asking me if I wanted to downgrade my protocol to HTTP.<p>2) The domain &quot;google&quot; made me and several others wonder if there was a hosts file entry for &quot;google&quot;, which turns out there isn&#x27;t.<p>No, of course, the real problem is much more complicated; a strange twist of omnibar meets DNS meets HSTS. This is definitely an edge case, but might be a glimpse into the complicated future of gTLDs and the emergence of ever-more web standards...
评论 #13803524 未加载
marcosdumayabout 8 years ago
One very bad idea meets another.<p>Now, let&#x27;s make every program more user friendly by obscuring the meaning of our input fields and creating very complex rules for how they&#x27;ll act... Oh, wait, our programmers aren&#x27;t able to understand our rules anymore? Nah, we are an AI company, we can live with that.
unethical_banabout 8 years ago
&#x2F;Insert grumblings about insecurity of the omnibox (leaking internal corporate data) and my personal preference for firefox-style URL box and search box.
评论 #13802818 未加载
coderobeabout 8 years ago
This causes funny behavior like <a href="https:&#x2F;&#x2F;pbs.twimg.com&#x2F;media&#x2F;C6L3IvsUsAABuyS.jpg:large" rel="nofollow">https:&#x2F;&#x2F;pbs.twimg.com&#x2F;media&#x2F;C6L3IvsUsAABuyS.jpg:large</a><p>Chrom(e|ium) will suggest to navigate to <a href="http:&#x2F;&#x2F;google" rel="nofollow">http:&#x2F;&#x2F;google</a> if you&#x27;re opening google.com
评论 #13802791 未加载
zevebabout 8 years ago
Honestly, although I use the Omnibox&#x2F;Awesome Bar&#x2F;whatever a lot, I think it is ultimately a mistake: there are too many search terms which end up resolving to domains, esp. for a developer — and it was never a problem to just click in the search bar before I ruined my muscle memory and started clicking in the location bar instead.<p>One of these days I&#x27;ll just disable it altogether.
draw_downabout 8 years ago
I understand why we have the omnibox, but worth pointing out that this problem was solved long ago when URL &amp; search bars were separate.
rnhmjojabout 8 years ago
Is a TLD alone technically a valid host name?
评论 #13802884 未加载
评论 #13803426 未加载
评论 #13803536 未加载
评论 #13802858 未加载
coderobeabout 8 years ago
To whoever edited my title: The bug report title is inaccurate. It&#x27;s specifically about HSTS preloads, which is why my original title stated that instead of &quot;gTLDs&quot;.
评论 #13805519 未加载
评论 #13803913 未加载
评论 #13803101 未加载