TE
TechEcho
Home24h TopNewestBestAskShowJobs
GitHubTwitter
Home

TechEcho

A tech news platform built with Next.js, providing global tech news and discussions.

GitHubTwitter

Home

HomeNewestBestAskShowJobs

Resources

HackerNews APIOriginal HackerNewsNext.js

© 2025 TechEcho. All rights reserved.

Peter Sunde: dark.fail domain was hijacked through fake court order

38 pointsby ylereabout 4 years ago

3 comments

g_pabout 4 years ago
If anything, hopefully this highlights the weaknesses that many digital systems have, to intervention from those in the analogue world (like courts), who seem blissfully unaware of the ease with which documents like this can be forged. And similarly for those willing to accept such unauthenticated documents and blindly trust anything that vaguely looks official and arriving by email.<p>Similar processes are in place for other (very systems, and paper based processes don&#x27;t protect against this. We have the technology to avoid this (digital signatures), and yet they are not used!<p>A good reason to ensure that systems are built securely on the assumption upstream providers (including DNS) can be compromised by an adversary, regardless of how much you may think you trust the provider. If someone cares enough, they&#x27;ll get certificates issued under your domain by doing something like this. Adding more lines of defence certainly makes sense to prevent this - don&#x27;t let DNS, and ultimately emailed bits of paper, become your single point of failure for confidentiality in a system!
ylereabout 4 years ago
dark.fail used to host up-to-date links to many major darknet sites hosted on the tor network. The attacker kept the site online with minor changes and now anyone who visits these links will have the connection go through MITM proxies and their credentials stolen. It&#x27;s difficult to understand why namecheap hasn&#x27;t at least shut down the domain after days of this going on.
评论 #27031980 未加载
评论 #27032710 未加载
shaknaabout 4 years ago
&gt; BONUS 3: If @Namecheap is claiming the court order is correct, they must believe that the German court has themselves put up a phishing site.<p>There&#x27;d be nothing surprising about this. It isn&#x27;t a point in favour of the court order being &quot;fake&quot;.<p>When the takeover of Hansa [0], a collaboration between German and Dutch LE, happened they did actually alter the code of the website in ways identical to phishing. Collecting usernames, passwords, and location information.<p>[0] <a href="https:&#x2F;&#x2F;www.wired.com&#x2F;story&#x2F;hansa-dutch-police-sting-operation&#x2F;" rel="nofollow">https:&#x2F;&#x2F;www.wired.com&#x2F;story&#x2F;hansa-dutch-police-sting-operati...</a>